Yarn installing private modules without credentials

[furstenheim]

Do you want to request a feature or report a bug?
Bug

What is the current behavior?
In the same host I have two different projects. One project "A" with a .npmrc file, the other "B" one without.
Package json requires a private module that is only accessible in npm with the .npmrc credentials.
If I execute yarn add @private-scope/private-module it works in A and it fails in B, as expected.

However, If I run yarn install it works in both, even though B depends on a private package and it has no access to it.

After executing yarn clean cache the same command fails on B with message:

Extracting tar content of undefined failed, the file appears to be corrupt: "Unexpected end of data"

What is the expected behavior?

In the project without .npmrc credentials yarn install should consistently fail. Not be dependent on cache.

Please mention your node.js, yarn and operating system version.

yarn version 1.12.3
Node version 8