The remote source (if any) should be resolved from the lock-file if possible to identify forked packages