Yes, I have more or less come up to the same conclusion, and yes, as you can see from the imagines, the package.lock.json exists only in the .node-red folder.
It would have been useful to have the possibility of installing/upgrading nodes from whatever instance and have them available within all the others. But actually it doesn't seem to be possibile. (In my opinion it will be nice to have an option in settings.js to specify the path to use for it)
So, in conclusion at moment the best way to achieve something similar is create soft links to .node-red\node-modules and .node-red\package.json. At this point you install/update nodes only from the main instance in node-red, and they will be available in all the other instances (which have been linked to the main one and after their restarted, of course)
Thanks to all for the supports
