[BUG] unable to resolve dependency tree

Current Behavior:

Under certain conditions using npm pack on a dependency and later npm install xyz-1.2.3.tgz fails to install even when the same published package works when installed via registry.

See detailed steps to reproduce below but a short summary is:

• @sandbox/base have no dependencies (published as 1.0.0)
• @sandbox/plugin have a peerDependency on @sandbox/base ^1` (published as 1.0.0)
• third-party have a peerDependency on both @sandbox/base ^1 and @sandbox/plugin ^1 (published as 1.0.0)
• app have dependency on @sandbox/base and third-party and devDependency on @sandbox/plugin

Installing using npm install works as expected but trying to install tarballs created with npm pack fails:

npm WARN tarball tarball data for @sandbox/plugin@file:../plugin/sandbox-plugin-1.0.0.tgz (null) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @sandbox/plugin@file:../plugin/sandbox-plugin-1.0.0.tgz (null) seems to be corrupted. Trying again.
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: my-app@1.0.0
npm ERR! Found: @sandbox/plugin@undefined
npm ERR! node_modules/@sandbox/plugin
npm ERR!   dev @sandbox/plugin@"file:../plugin/sandbox-plugin-1.0.0.tgz" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer @sandbox/plugin@"^1" from third-party@1.0.0
npm ERR! node_modules/third-party
npm ERR!   third-party@"file:../third-party/third-party-1.0.0.tgz" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /home/ext/.npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/ext/.npm/_logs/2021-02-20T13_03_48_472Z-debug.log

Using --legacy-peer-deps works as expected.

Two things stand out:

"tarball data for @sandbox/plugin@file:../plugin/sandbox-plugin-1.0.0.tgz (null) seems to be corrupted. Trying again."

and

"Found: @sandbox/plugin@undefined"

The contens of eresolve-report.txt is the following:

# npm resolution error report

2021-02-20T13:42:00.931Z

While resolving: my-app@1.0.0
Found: @sandbox/plugin@undefined
node_modules/@sandbox/plugin
  dev @sandbox/plugin@"file:../plugin/sandbox-plugin-1.0.0.tgz" from the root project

Could not resolve dependency:
peer @sandbox/plugin@"^1" from third-party@1.0.0
node_modules/third-party
  third-party@"file:../third-party/third-party-1.0.0.tgz" from the root project

Fix the upstream dependency conflict, or retry
this command with --force, or --legacy-peer-deps
to accept an incorrect (and potentially broken) dependency resolution.

Raw JSON explanation object:

{
  "code": "ERESOLVE",
  "current": {
    "name": "@sandbox/plugin",
    "errors": [
      {
        "errno": -2,
        "code": "ENOENT",
        "syscall": "open",
        "path": "/plugin/sandbox-plugin-1.0.0.tgz",
        "requiredBy": "."
      }
    ],
    "package": {},
    "whileInstalling": {
      "name": "my-app",
      "version": "1.0.0",
      "path": "/home/ext/temp/npm-7-pack/app"
    },
    "location": "node_modules/@sandbox/plugin",
    "dependents": [
      {
        "type": "dev",
        "name": "@sandbox/plugin",
        "spec": "file:../plugin/sandbox-plugin-1.0.0.tgz",
        "error": "INVALID",
        "from": {
          "location": "/home/ext/temp/npm-7-pack/app"
        }
      }
    ]
  },
  "edge": {
    "type": "peer",
    "name": "@sandbox/plugin",
    "spec": "^1",
    "error": "INVALID",
    "from": {
      "name": "third-party",
      "version": "1.0.0",
      "whileInstalling": {
        "name": "my-app",
        "version": "1.0.0",
        "path": "/home/ext/temp/npm-7-pack/app"
      },
      "location": "node_modules/third-party",
      "dependents": [
        {
          "type": "prod",
          "name": "third-party",
          "spec": "file:../third-party/third-party-1.0.0.tgz",
          "error": "INVALID",
          "from": {
            "location": "/home/ext/temp/npm-7-pack/app"
          }
        }
      ]
    }
  },
  "peerConflict": null,
  "strictPeerDeps": false,
  "force": false
}

Expected Behavior:

No error.

Steps To Reproduce:

There is a github repository demonstrating the issue at https://github.com/ext/npm-7-pack-bug which is probably the simplest way to reproduce the issue. Following the instructions in README.md triggers the issue.

This is the simplest form I've reproduced this error but it might be possible to further reduce it.

Otherwise:

1. Create package @sandbox/base at version 1.0.0, publish to registry, create tarball with npm pack
2. Create package @sandbox/plugin at version 1.0.0 with peerDependency on @sandbox/baseat^1, publish to registry, create tarball with npm pack`
3. Create package third-party at version 1.0.0 with peerDependency on @sandbox/base at ^1 and @sandbox/plugin at ^1, publish to registry, create tarball with npm pack
4. Create application app with dependency on @sandbox/base at 1.0.0 and third-party at 1.0.0 and devDependency on @sandbox/plugin at 1.0.0.
5. Install dependencies with npm install
6. Use npm install sandbox-base-1.0.0.tgz sandbox-plugin-1.0.0.tgz third-party-1.0.0.tgz

Environment:

• OS: Ubuntu 20.20
• Node: 14.15.3
• NPM: 7.5.4

Start with the README.md and reproduction repository at github.com/ext/npm-7-pack-bug, then run the documented npm install commands using the packed tarballs. Compare the tarball and registry installation paths, focusing on the ERESOLVE report showing the package as undefined. Done means the tarball installation succeeds without --legacy-peer-deps while the registry case continues to work.