[BUG] Aliases of NPM packages are broken when used in dependencies

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Dependencies in the following package.json file are not resolved correctly:

{
  "dependencies": {
    "once": "^1.4.0",
    "pikchr-wasm": "^1.0.1"
  }
}

This is installed:

├─┬ once@1.4.0
│ └── wrappy@1.0.2
└─┬ pikchr-wasm@1.0.1
  └── once@1.4.0 deduped

Expected Behavior

Notice how the wrong once module got installed for pikchr-wasm, it's dependency tree should look like this:

pikchr-wasm@1.0.1
└── once@npm:@fabiospampinato/once@1.0.0

I guess the problem is that NPM got confused since I'm using an alias for a module, and that alias is the name of another module that the parent package needs.

Steps To Reproduce

Run npm i on that package.json.

Environment

• npm: 8.3.0
• Node: 17.3.0
• OS: macOS 12.1
• platform: arm64
• npm config:

; "user" config from /Users/fabio/.npmrc

//registry.npmjs.org/:_authToken = (protected) 
init.author.email = "spampinabio@gmail.com" 
init.author.name = "Fabio Spampinato" 
package-lock = false 
script-shell = "zsh" 

; node bin location = /Users/fabio/.nvm/versions/node/v16.13.0/bin/node
; cwd = /Users/fabio/Desktop/asd
; HOME = /Users/fabio
; Run `npm config ls -l` to show all defaults.

Start with the package.json dependency example and run npm i to reproduce the installed tree. Compare the resolved once dependency under pikchr-wasm with the expected once@npm:@fabiospampinato/once@1.0.0 alias. Done means npm preserves the alias rather than using the top-level once package.