[BUG] Deep dependency in workspace missing

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

• mono repo with multiple workspaces
• one workspace includes browserify@17.0.0
• after non-failing npm install, missing at least one deep normal dependency (dep path is all non-dev non-bundled dep)
• dep path: workspace(browserify) > browserify@17.0.0 > util@0.12.3 > (missing) is-generator-function@^1.0.7

package-lock.json includes 2 references, showing that it recognizes its a dependency

   ...
    "packages/browserify/node_modules/util": {
      "version": "0.12.4",
      ...
      "dependencies": {
        ...
        "is-generator-function": "^1.0.7",
        ...
      }
    },

        "util": {
          "version": "0.12.4",
          "dev": true,
          "requires": {
            ...
            "is-generator-function": "^1.0.7",
            ...
          }
        }

but does not include any entry for is-generator-function

Expected Behavior

it should install the full tree of non-dev deep deps

Steps To Reproduce

1. this repo and branch https://github.com/lavamoat/lavamoat/tree/npm-hell

➜ node -v
v14.17.6
➜ npm -v
8.5.2

2. npm install from root
3. npm ls util confirm parent deep dep is installed (as expected)

➜ npm ls util      
lavamoat@ /home/user/Development/LavaMoat
├─┬ lavamoat-browserify@14.1.0 -> ./packages/browserify
│ └─┬ browserify@17.0.0
│   ├─┬ assert@1.5.0
│   │ └── util@0.10.3
│   └── util@0.12.4
├─┬ lavamoat-perf@0.0.0 -> ./packages/perf
│ └─┬ browserify@16.5.2
│   └── util@0.10.4
└─┬ lavamoat-viz@6.0.9 -> ./packages/viz
  └─┬ webpack@4.37.0
    └─┬ node-libs-browser@2.2.1
      └── util@0.11.1

4. npm ls is-generator-function confirm deep dep is NOT installed (bug!)

➜ npm ls is-generator-function
lavamoat@ /home/user/Development/LavaMoat
└── (empty)

Environment

• npm: 8.5.2
• Node.js: 14.17.6
• OS Name: pop-os
• System Model Name: system76
• npm config:

 "user" config from /home/user/.npmrc

//registry.npmjs.org/:_authToken = (protected) 

; "project" config from /home/user/Development/LavaMoat/.npmrc

ignore-scripts = true 

; node bin location = /home/user/.nvm/versions/node/v14.17.6/bin/node
; cwd = /home/user/Development/LavaMoat
; HOME = /home/user
; Run `npm config ls -l` to show all defaults.

Reproduce the report from the linked Lavamoat npm-hell branch with npm install, then compare package-lock.json with npm ls util and npm ls is-generator-function. Trace the workspace(browserify) dependency path through browserify@17.0.0 and util@0.12.3; done means the missing non-dev dependency and its full tree are installed.