[BUG] `npm install` fails with npm ERR! Cannot read property 'sourceReference' of null

Current Behavior:

I get a failure when running npm install without an existing package-lock.json with a specific package.json file.

The failure I get is:

npm ERR! Cannot read property 'sourceReference' of null

From the debug log, here's the stack trace:

10602 verbose stack TypeError: Cannot read property 'sourceReference' of null
10602 verbose stack     at Arborist.[placeDep] (/Users/blimmer/.asdf/installs/nodejs/16.1.0/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:1462:44)
10602 verbose stack     at /Users/blimmer/.asdf/installs/nodejs/16.1.0/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:905:46
10602 verbose stack     at Array.map (<anonymous>)
10602 verbose stack     at Arborist.[buildDepStep] (/Users/blimmer/.asdf/installs/nodejs/16.1.0/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:905:8)
10602 verbose stack     at async Arborist.buildIdealTree (/Users/blimmer/.asdf/installs/nodejs/16.1.0/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:218:7)
10602 verbose stack     at async Promise.all (index 1)
10602 verbose stack     at async Arborist.reify (/Users/blimmer/.asdf/installs/nodejs/16.1.0/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js:135:5)
10602 verbose stack     at async Install.install (/Users/blimmer/.asdf/installs/nodejs/16.1.0/lib/node_modules/npm/lib/install.js:137:5)

Here's the full debug log: https://github.com/blimmer/npm-bug-report/blob/main/debug.log

Expected Behavior:

I expect npm install to succeed and create a package-lock.json file.

Steps To Reproduce:

1. Use this package.json file
2. Run npm i

I've created a sample repository here with a GitHub action to show the failure.

Environment:

OS: Mac OS 11.3.1 and Ubuntu latest
Node: 16.1.0
npm: 7.11.2

Start with @npmcli/arborist/lib/arborist/build-ideal-tree.js, especially the [placeDep] location at line 1462 in the reported stack trace. Reproduce with the linked package.json by running npm install, then verify that installation succeeds and creates package-lock.json instead of raising the sourceReference error.