[BUG] --package-lock-only option fails with scoped private packages, regression

[bigtimebuddy]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Minimal reproduction is here:
https://github.com/bigtimebuddy/npm-bug-package-lock-only

Package structure is roughly this:

• packages/package-a (@package/a)
  • devDependencies
    • @tools/a
• package/tools-a (@tools/a) private

After doing a version bump of my workspaces packages, I use --package-lock-only option to update the package-lock.json file. Prior to npm@7.20.2 this worked fine. After then, it fails with the following message:

npm ERR! code E404
npm ERR! 404 Not Found - GET https://registry.npmjs.org/@tools%2fa - Not found
npm ERR! 404 
npm ERR! 404  '@tools/a@2.0.0' is not in this registry.
npm ERR! 404 You should bug the author to publish it (or use the name yourself!)
npm ERR! 404 
npm ERR! 404 Note that you can also install from a
npm ERR! 404 tarball, folder, http url, or git url.

npm ERR! A complete log of this run can be found in:
npm ERR!     ~/.npm/_logs/2021-10-29T17_43_19_186Z-debug.log

Additional Links

Changed was introduced here: v7.20.2...v7.20.3
Additional context here: lerna/lerna#2891

Expected Behavior

With the reproduction, should get the following and not fail.

up to date, audited 6 packages in 1s

found 0 vulnerabilities

Steps To Reproduce

git clone https://github.com/bigtimebuddy/npm-bug-package-lock-only`
cd npm-bug-package-lock-only
npm i npm@8 -g
npm test

Environment

• OS: macOS v11.6
• Node: v12.20.1
• npm: v8.1.2

[bigtimebuddy]

Duplicate of #3637

[ljharb]

In that case, it should be fixed in c99c215, in v8.4.0.

[bigtimebuddy]

It is not fixed in 8.4.0, issue above still reproduces.

[ljharb]

in that case, can you comment that on #3637?