[BUG] Cannot convert undefined or null to object on unpublished package

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

When doing npm install and there is a package installed from github that has the same name as an unpublished package in npm, the error "Cannot convert undefined or null to object" appears. See https://github.com/npm/metavuln-calculator/pull/7#issuecomment-989099759 and https://github.com/npm/metavuln-calculator/issues/12

The security audit causes a crash in npm. We cannot easily rename internally managed packages simply to avoid colliding with an unpublished npm package.

Expected Behavior

I expected the install to succeed (as it did in npm version 6).

Steps To Reproduce

1. Create a package.json that references a github repository with the same name as an unpublished package. e.g.

  "dependencies": {
    "mwater-forms": "github:mWater/mwater-forms"
  },

2. With latest npm
3. Run npm install
4. See error: "Cannot convert undefined or null to object"

Environment

• npm: 8.3.2
• Node.js: v16.13.2
• OS Name: Mint 20.3
• System Model Name: Dell?
• npm config:

; "user" config from /home/clayton/.npmrc

//registry.npmjs.org/:_authToken = (protected) 

; node bin location = /home/clayton/.nvm/versions/node/v16.13.2/bin/node
; cwd = /home/clayton/dev/scratch/failnpm
; HOME = /home/clayton
; Run `npm config ls -l` to show all defaults.

Reproduce the failure with the package.json dependency shown and npm 8.3.2, then trace the security-audit path implicated by the report. Review the linked metavuln-calculator pull request and issue for context; done means npm install succeeds when a GitHub package collides with an unpublished npm package.