Npm5 flipflops on deps corruption during sibling dir installs

[avaer]

I'm opening this issue because:

• npm is crashing.
• npm is producing an incorrect install.
• npm is doing something I don't understand.
• Other (see below for feature requests):

What's going wrong?

How can the CLI team reproduce the problem?

1. Clear all node_modules, package.json, package-lock.json, etc. from your tree.

mkdir lol;
echo '{"name":"lol","dependencies":{"express":""}}'>lol/package.json
mkdir -p lol2/node_modules;
cd lol2;
npm i ../lol;

This is ok. lol will get express installed into itself as expected. But then...

npm i ../lol; # yes, install same thing again

Now this will report updated 1 package in 0.515s, but what it actually did is blow away all deps of lol, so that install is broken. But if you do it again...

npm i ../lol; # yes, install same thing again

Now you get back the deps and the install is ok. If you install again it will flip-flop between corruption and ok install.

Basically, npm i is non-idempotent (and corrupting) for local sibling dir installs. This seems to be the case regardless of whether you're shrinkwrapping or not.

Possibly related: #16839. But I didn't see this exact case mentioned there.

supporting information:

• npm -v prints: 5.0.3
• node -v prints: v8.0.0
• npm config get registry prints: https://registry.npmjs.org/
• Windows, OS X/macOS, or Linux?: Linux