[BUG] aliased dependencies incorrectly de-dupe a transitive dependency

Current Behavior:

When installing a direct dependency using the alias syntax e.g. npm install jose@npm:jose-node-esm-runtime my other dependencies that depend on jose start requiring jose-node-esm-runtime instead.

Expected Behavior:

Aliased modules do not trigger de-dupe based on the alias value.

Steps To Reproduce:

mkdir poc && cd poc
npm init -y
npm install oidc-provider
node -e 'require("oidc-provider")' // works
npm install jose@npm:jose-node-esm-runtime
node -e 'require("oidc-provider")' // throws because the `jose` depended upon by oidc-provider is gone and was replaced by jose-node-esm-runtime
// the throw itself is not important, it's throwing because the oidc-provider > jose dependency is gone from node_modules

// further quirks
npm uninstall jose
node -e 'require("oidc-provider")' // still wrong because jose is still resolved to `jose-node-esm-runtime` in package-lock.json, eventho it is no longer to be found in package.json

Environment:

Node 14.16.0
npm 7.11.1, npm@6 as well

Reproduce the issue with the listed npm install, uninstall, and node commands, then inspect dependency de-duplication and package-lock.json resolution. Done means installing the aliased direct dependency does not replace the transitive jose dependency, and uninstalling it leaves dependency resolution consistent with package.json.