I think we should just add it to the repo itself. But it should be added to our .npmignore as well if they're not already.

We don't have yarn.lock in our .npmignore, which is almost the same thing. And I think new versions of npm will ignore it anyway:

One key detail about package-lock.json is that it cannot be published, and it will be ignored if found in any place other than the toplevel package. It shares a format with npm-shrinkwrap.json, which is essentially the same file, but allows publication. This is not recommended unless deploying a CLI tool or otherwise using the publication process for producing production packages. [source]