Installing a package with npm 5 with the option --only=dev removes other packages from node_modules

[mihaicostin]

I'm opening this issue because:

• npm is crashing.
• npm is producing an incorrect install.
• npm is doing something I don't understand.
• Other (see below for feature requests):

What's going wrong?

Installing a package with the option --only=dev removes other packages from node_modules and package-lock.json

How can the CLI team reproduce the problem?

> npm init
...
> npm install ncp
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN testprj@1.0.0 No description
npm WARN testprj@1.0.0 No repository field.
+ ncp@2.0.0
added 1 package in 0.772s
> npm install chalk
npm WARN testprj@1.0.0 No description
npm WARN testprj@1.0.0 No repository field.
+ chalk@1.1.3
added 7 packages in 1.026s
npm install chalk --only=dev
npm WARN testprj@1.0.0 No description
npm WARN testprj@1.0.0 No repository field.
+ chalk@1.1.3
removed 1 package and updated 1 package in 0.66s

=> after the last operation, package ncp was removed from node_modules and package-lock.json

supporting information:

• npm -v prints: 5.0.3
• node -v prints: v6.10.3
• npm config get registry prints: https://registry.npmjs.org/
• Windows, OS X/macOS, or Linux?: OS X
• Network issues:
  • Geographic location where npm was run:
  • I use a proxy to connect to the npm registry.
  • I use a proxy to connect to the web.
  • I use a proxy when downloading Git repos.
  • I access the npm registry via a VPN
  • I don't use a proxy, but have limited or unreliable internet access.
• Container:
  • I develop using Vagrant on Windows.
  • I develop using Vagrant on OS X or Linux.
  • I develop / deploy using Docker.
  • I deploy to a PaaS (Triton, Heroku).