[BUG] Aliases of NPM packages are broken when used in dependencies

[fabiospampinato]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Dependencies in the following package.json file are not resolved correctly:

{
  "dependencies": {
    "once": "^1.4.0",
    "pikchr-wasm": "^1.0.1"
  }
}

This is installed:

├─┬ once@1.4.0
│ └── wrappy@1.0.2
└─┬ pikchr-wasm@1.0.1
  └── once@1.4.0 deduped

Expected Behavior

Notice how the wrong once module got installed for pikchr-wasm, it's dependency tree should look like this:

pikchr-wasm@1.0.1
└── once@npm:@fabiospampinato/once@1.0.0

I guess the problem is that NPM got confused since I'm using an alias for a module, and that alias is the name of another module that the parent package needs.

Steps To Reproduce

Run npm i on that package.json.

Environment

• npm: 8.3.0
• Node: 17.3.0
• OS: macOS 12.1
• platform: arm64
• npm config:

; "user" config from /Users/fabio/.npmrc

//registry.npmjs.org/:_authToken = (protected) 
init.author.email = "spampinabio@gmail.com" 
init.author.name = "Fabio Spampinato" 
package-lock = false 
script-shell = "zsh" 

; node bin location = /Users/fabio/.nvm/versions/node/v16.13.0/bin/node
; cwd = /Users/fabio/Desktop/asd
; HOME = /Users/fabio
; Run `npm config ls -l` to show all defaults.

[fabiospampinato]

I just checked that it reproduces on latest under Node v17 too.

[ruyadorno]

hi @fabiospampinato thanks for reporting this issue, just to be sure, the problem here is that npm ls is reporting the wrong package name (not following the alias) ? Everything else works fine in the installation?

[fabiospampinato]

No, npm installed the wrong package. You can check manually what got installed.

[regseb]

I have the same problem #7884, but only if the version numbers of the two dependencies are identical.

• playwright uses "1.48.2"

  {
    "name": "playwright",
    "version": "1.48.2",
    /* ... */
    "dependencies": {
      "playwright-core": "1.48.2"
    },
    /* ... */
  }

• rebrowser-playwright uses "npm:rebrowser-playwright-core@~1.48.2"

  {
    "name": "rebrowser-playwright",
    "version": "1.48.2",
    /* ... */
    "dependencies": {
      "playwright-core": "npm:rebrowser-playwright-core@~1.48.2"
    },
    /* ... */
  }

{
  "name": "testcase",
  "version": "1.0.0",
  "dependencies": {
    "playwright": "1.48.2",
    "rebrowser-playwright": "1.48.2"
  }
}

$ npm list --all
testcase@1.0.0 /home/regseb/testcase
├─┬ playwright@1.48.2
│ └── playwright-core@1.48.2
└─┬ rebrowser-playwright@1.48.2
  └── playwright-core@1.48.2 deduped 👎

---

With different versions, packages are not deduplicated:

{
  "name": "testcase",
  "version": "1.0.0",
  "dependencies": {
    "playwright": "1.48.1",
    "rebrowser-playwright": "1.48.2"
  }
}

$ npm list --all
testcase@1.0.0 /home/regseb/testcase
├─┬ playwright@1.48.1
│ └── playwright-core@1.48.1
└─┬ rebrowser-playwright@1.48.2
  └── playwright-core@npm:rebrowser-playwright-core@1.48.2 👍