[BUG] package.json has "lockfileVersion": 2 but is missing "hasInstallScript": true

My apologies if this is a duplicate. The closest I could find is https://github.com/npm/cli/issues/1905, but the fix didn't solve the problem in this issue.

Current Behavior:

The user-facing issue is that you can get into a state where npm ci fails to run the postinstall scripts of all of your dependencies, resulting in broken packages. This appears to be because of a missing "hasInstallScript": true in my package-lock.json file.

I'm not familiar with npm's internals but I did some debugging and I believe one way to get into this state is by running npm install on a package-lock.json file with "lockfileVersion": 1 with npm v7. This upgrades the package-lock.json file to "lockfileVersion": 2 but doesn't add "hasInstallScript": true where it would usually be added. That then causes npm ci to fail to reinstall the package correctly. There may also be other ways of getting into this state.

Expected Behavior:

I expect running npm ci on a package-lock.json file that has been upgraded from "lockfileVersion": 1 to "lockfileVersion": 2 to behave the same as npm ci on a package-lock.json file that was always "lockfileVersion": 2.

Steps To Reproduce:

Steps to demonstrate the current unexpected behavior:

$ npm i -g npm@6.14.11
$ echo '{}' > package.json
$ npm i esbuild@0.8.39
$ cat package-lock.json | grep -E 'lockfileVersion|hasInstallScript'
  "lockfileVersion": 1,
$ npm i -g npm@7.5.2
$ npm i esbuild@0.8.39
$ cat package-lock.json | grep -E 'lockfileVersion|hasInstallScript'
  "lockfileVersion": 2,
$ npm ci
$ ./node_modules/.bin/esbuild --version
Error: esbuild: Failed to install correctly

Steps to demonstrate the desired behavior:

$ npm i -g npm@7.5.2
$ echo '{}' > package.json
$ npm i esbuild@0.8.39
$ cat package-lock.json | grep -E 'lockfileVersion|hasInstallScript'
  "lockfileVersion": 2,
      "hasInstallScript": true,
$ npm ci
$ ./node_modules/.bin/esbuild --version
0.8.39

Environment:

• OS: macOS 10.15.7
• Node: 15.2.0
• npm: 7.5.2

Reproduce the upgrade path from npm 6 with a lockfileVersion 1 package-lock.json to npm 7, then run npm ci with esbuild as shown. Trace the lockfile migration and install-script handling; done means the upgraded lockfile records hasInstallScript for packages needing it and npm ci runs their postinstall scripts correctly.