Comment by felixfbecker

No they could not. Because your package-lock.json contains integrity hashes that are verified during installation.