[BUG] Incorrect "resolved" URL in package-lock.json

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

npm resolved a dependency to the wrong archive on the registry. Snippet from my package-lock.json

"node_modules/@babel/types": {
      "version": "7.15.0",
      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.14.9.tgz",
      "integrity": "sha512-OBvfqnllOIdX4ojTHpwZbpvz4j3EWyjkZEdmjH0/cgsd6QOdSgU8rLSk6ard/pcW7rlmjdVSX/AWOaORR1uNOQ==",

Notice that the version is 7.15.0 but the resolved field points at types-7.14.9.tgz. The integrity check matches 7.15.0's shasum. I'm not sure how this happened, but on this particular branch I did end up having to resolve conflicts automatically using npm install.

I've been debugging this for a couple of hours because this build only failed to install while creating a Docker image (so basically installing from a clean slate), while it worked fine locally, where I had a full npm cache. Locally I could successfully install both with npm install and npm ci. Forcefully clearing the cache (with npm cache clear --force) recreated the issue locally as well.

Expected Behavior

npm should resolve packages to the right archive for the specified package version.

Steps To Reproduce

Not sure how this happened. I suspect it was caused by solving git conflicts with npm install.

Environment

• OS: Mac OS
• Node: 16.5.0
• npm: 7.20.5, but it might have been an older version when I was solving conflicts (still in the 7.20.x range though)

Start with the package-lock.json snippet and compare the version, resolved archive, and integrity values. Reproduce with npm 7.20.x after clearing the npm cache, using both npm install and npm ci in a clean Docker install; done means the resolved archive matches the specified package version.