title: npm "resolved"-fields in package-lock.json change constantly with JFrog artifactory
body: <p>We have a private JFrog artifactory (name anonymised below) that npm is configured in a project root .npmrc -file:</p>
  
  <pre><code>registry=https://artifactory.jfrog.private.com:443/api/npm/npm-registry-virtual/
  </code></pre>
  
  <p>The resolved-field in the package-lock.json file shared via Git between developers is constantly changing between runs of "npm install" without any changes to package.json. </p>
  
  <p>Some times a dl query parameter (pointing to the exactly same URL) gets added to the resolved URL:</p>
  
  <pre><code>- "resolved": "https://artifactory.jfrog.private.com:443/api/npm/npm-registry-virtual/@sailshq/lodash/-/lodash-3.10.3.tgz",
  + "resolved": "https://artifactory.jfrog.private.com:443/api/npm/npm-registry-virtual/@sailshq/lodash/-/lodash-3.10.3.tgz?dl=https://artifactory.jfrog.private.com/@sailshq/lodash/-/lodash-3.10.3.tgz",
  </code></pre>
  
  <p>Some times the query parameter points to npmjs.org registry:</p>
  
  <pre><code> - "resolved": "https://artifactory.jfrog.private.com:443/api/npm/npm-registry-virtual/aproba/-/aproba-1.2.0.tgz",
   - "resolved": "https://artifactory.jfrog.private.com:443/api/npm/npm-registry-virtual/aproba/-/aproba-1.2.0.tgz?dl=https://registry.npmjs.org/aproba/-/aproba-1.2.0.tgz",
  </code></pre>
  
  <p>And some times the field points directly to npmjs.org repository:</p>
  
  <pre><code>- "resolved": "https://artifactory.jfrog.private.com:443/api/npm/npm-registry-virtual/acorn/-/acorn-3.3.0.tgz",
  + "resolved": "https://registry.npmjs.org/acorn/-/acorn-3.3.0.tgz",
  </code></pre>
  
  <p>Any of these changes may also go to the inverse direction.</p>
  
  <p>This is really irritating, since it means we constantly have meaningless changes in package-lock.json, which causes merge conflicts and often prevents npm ci from executing correctly. npm cache clean --force does not seem to help. I know that npm install can resolve package-lock.json merge conflicts automatically, but that does not help with npm ci (since the whole point is to <strong>not</strong> run npm install in the CI environment). And, anyway, what is the benefit of seeing how the virtual npm registry resolves the packages internally (as I suspect is happening here)?</p>
  
  <p>Is there some kind of configuration option to prevent JFrog Artifactory from making these kinds of changes to the resolved package URLs in a virtual npm registry? Or is it maybe a bug in npm?</p>
  
  <p>Environment: </p>
  
  <ul>
  <li>npm 6.11.3 </li>
  <li>JFrog Artifactory 6.10.6</li>
  </ul>