Things like package-lock.json exists just so you can reproduce exact build. Don't vendor your dependencies and you'll be fine with hundreds of React apps in your Dropbox.