Mascarade, a board game. It’s a game of hidden indentities, where everyone can lie to try to get all the money and win the game. I’ve had A LOT of fun playing with as much as 10 people. The game can be played between 2 and 13 players, but less than 4 I think it’s not that worth.
The behaviour you mention is from npm install, which will put the same exact version from the package-lock.json, if present. If not it will act as an npm update.
npm update will always update, and rewrite the package-lock.json file with the latest version available that complies with the restrictions defined on the package.json.
I may be wrong but, I think the difference may be that python only has the behaviour that package-lock.json offer, but not the package.json, which allows the developer to put constraints on which is the max/min version allowed to install.