As @slebetman have mentioned in the comments you've probably ran npm install with sudo or root privileges, leading to the package-lock.json file being owned by root.

Since the other answers are based on Docker, I'd thought I'd give the Linux/Unix solution for people who are in my situation running their locally. Run the command:

sudo chown NAME-OF-YOUR-USER package-lock.json

The command will change the owner of the file resolving the permission conflict you're experiencing.