Running `npm install` without `--no-save` can introduce spurious changes to package-lock.json due to differences in platform / node version, and these have been known to accidentally sneak into people's PRs. `npm install` without `--no-save` should only be used when actively updating node dependencies in package.json.