[BUG] npm i --no-save emits lockfile warning when there is no lockfile in the project

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

When using npm install --no-save in a project that has packages installed in node_modules but no package-lock.json file, the command completes successfully but gives the following output:

npm WARN old lockfile 
npm WARN old lockfile The package-lock.json file was created with an old version of npm,
npm WARN old lockfile so supplemental metadata must be fetched from the registry.
npm WARN old lockfile 
npm WARN old lockfile This is a one-time fix-up, please be patient...
npm WARN old lockfile

Afterwards, npm creates a file node_modules/.package-lock.json, if it did not exist before; this file being present doesn't disable the warning.

This mostly comes into play when using npm commands in a project which otherwise uses a different package manager with a different lockfile format, e.g. Yarn 1.x. My specific use-case is using npm install --no-save in a Yarn 1.x project in order to build a Typescript project against peer dependencies (Yarn has no equivalent to npm i --no-save). However, I've written my reproduction steps independent of any other package managers.

Expected Behavior

I don't want to receive the warning when using --no-save, because I have no intention of using a package-lock.json in this project. If a package-lock.json doesn't already exist in the project, npm can't be fixing up a file that doesn't exist. So I shouldn't be warned about something supposedly happening to a file that doesn't exist and won't be created.

If the fix-up process is what causes the creation of node_modules/.package-lock.json, I would probably expect that file not to be created when using --no-save.

Steps To Reproduce

1. In terminal, navigate to an empty directory
2. Set up an empty package.json, e.g. with npm init -y.
3. Install a package via npm install and then delete the package-lock.json file. Alternatively, install a package via another package manager which does not generate a lockfile (e.g. yarn add). The important bit is that packages are installed in node_modules and package-lock.json intentionally doesn't exist.
4. Use npm install --no-save to install a package without adding it to package.json. Observe the warning in console and the creation of node_modules/.package-lock.json.
5. Use npm install --no-save again. Observe the warning continues to appear.

Environment

• OS: WSL Ubuntu 20.04.2 under Win10 19041
• Node: 14.7.4
• npm: 7.21.0

No source file or test is named. Reproduce the warning with npm install --no-save in a project that has node_modules but no package-lock.json, then search the npm CLI code and tests for the “old lockfile” warning. Done means the warning and unintended node_modules/.package-lock.json creation no longer occur for this case.