code: public static JsonObject sanitize(JsonObject packageJson) {
          final JsonObjectBuilder payloadBuilder = Json.createObjectBuilder();
          final String projectName = packageJson.getString("name", "");
          final String projectVersion = packageJson.getString("version", "");
          if (!projectName.isEmpty()) {
              payloadBuilder.add("name", projectName);
          }
          if (!projectVersion.isEmpty()) {
              payloadBuilder.add("version", projectVersion);
          }
  
          // In most package-lock.json files, 'requires' is a boolean, however, NPM Audit expects
          // 'requires' to be an object containing key/value pairs corresponding to the module
          // name (key) and version (value).
          final JsonValue jsonValue = packageJson.get("requires");
          if (jsonValue.getValueType() != JsonValue.ValueType.OBJECT) {
              final JsonObjectBuilder requiresBuilder = Json.createObjectBuilder();
              final JsonObject dependencies = packageJson.getJsonObject("dependencies");
              for (String moduleName: dependencies.keySet()) {
                  final JsonObject module = dependencies.getJsonObject(moduleName);
                  final String version = module.getString("version");
                  requiresBuilder.add(moduleName, version);
              }
              payloadBuilder.add("requires", requiresBuilder.build());
          }
  
          payloadBuilder.add("dependencies", packageJson.getJsonObject("dependencies"));
          payloadBuilder.add("install", Json.createArrayBuilder().build());
          payloadBuilder.add("remove", Json.createArrayBuilder().build());
          payloadBuilder.add("metadata", Json.createObjectBuilder()
                  .add("npm_version", "6.1.0")
                  .add("node_version", "v10.5.0")
                  .add("platform", "linux")
          );
  
          // Create a new 'package-lock.json' object
          return payloadBuilder.build();
      }
docs: The NPM Audit API only accepts a modified version of package-lock.json.
  This method will make the necessary modifications in-memory, sanitizing
  non-public dependencies by omitting them, and returns a new 'sanitized'
  version.
  
  @param packageJson a raw package-lock.json file
  @return a modified/sanitized version of the package-lock.json file