[BUG] (Forced) Upgrade of package-lock file with aliases incorrectly tries to download the wrong package

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Latest npm is trying to download and install the wrong package when there are aliased packages.

To reproduce this, start with an older (e.g. v6) npm and install a package.

Edit the package-json or use npm alias command to alias, e.g.

"examplealias"  : "npm:highcharts@^9.3.3",

Run npm install to produce a v1 package-lock file.

Upgrade npm then run npm install.

npm WARN old lockfile
npm WARN old lockfile The package-lock.json file was created with an old version of npm,
npm WARN old lockfile so supplemental metadata must be fetched from the registry.
npm WARN old lockfile
npm WARN old lockfile This is a one-time fix-up, please be patient...
npm WARN old lockfile
npm WARN old lockfile HttpErrorGeneral: 404 Not Found - GET https://registry.npmjs.org/examplealias - Not found
npm WARN old lockfile     at C:\Users\rcocks\AppData\Roaming\npm\node_modules\npm\node_modules\npm-registry-fetch\lib\check-response.js:103:15
npm WARN old lockfile     at processTicksAndRejections (node:internal/process/task_queues:96:5)
npm WARN old lockfile     at async Array.<anonymous> (C:\Users\rcocks\AppData\Roaming\npm\node_modules\npm\node_modules\@npmcli\arborist\lib\arborist\build-ideal-tree.js:759:9)
npm WARN old lockfile  Could not fetch metadata for examplealias@10.0.0 HttpErrorGeneral: 404 Not Found - GET https://registry.npmjs.org/examplealias - Not found
npm WARN old lockfile     at C:\Users\rcocks\AppData\Roaming\npm\node_modules\npm\node_modules\npm-registry-fetch\lib\check-response.js:103:15
npm WARN old lockfile     at processTicksAndRejections (node:internal/process/task_queues:96:5)
npm WARN old lockfile     at async Array.<anonymous> (C:\Users\rcocks\AppData\Roaming\npm\node_modules\npm\node_modules\@npmcli\arborist\lib\arborist\build-ideal-tree.js:759:9) {
npm WARN old lockfile   headers: [Object: null prototype] {
npm WARN old lockfile     date: [ 'Mon, 21 Mar 2022 08:51:18 GMT' ],
npm WARN old lockfile     'content-type': [ 'application/json' ],
npm WARN old lockfile     'content-length': [ '21' ],
npm WARN old lockfile     connection: [ 'keep-alive' ],
npm WARN old lockfile     'cf-ray': [ '6ef571e5b8068880-LHR' ],
npm WARN old lockfile     vary: [ 'Accept-Encoding' ],
npm WARN old lockfile     'expect-ct': [
npm WARN old lockfile       'max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"'
npm WARN old lockfile     ],
npm WARN old lockfile     server: [ 'cloudflare' ],
npm WARN old lockfile     'x-fetch-attempts': [ '1' ],
npm WARN old lockfile     'x-local-cache-status': [ 'skip' ]
npm WARN old lockfile   },
npm WARN old lockfile   statusCode: 404,
npm WARN old lockfile   code: 'E404',
npm WARN old lockfile   method: 'GET',
npm WARN old lockfile   uri: 'https://registry.npmjs.org/examplealias',
npm WARN old lockfile   body: { error: 'Not found' },
npm WARN old lockfile   pkgid: 'examplealias@10.0.0'
npm WARN old lockfile }

Expected Behavior

Expected behaviour is that it should NOT try to download the "examplealias" package from npmjs.

If the package doesn't exist it produces a warning (which contains the string error: which trips up other software into think it's an error not a warning.).

Steps To Reproduce

1. npm install -g npm@6.14.16
2. npm init
3. npm install highcharts
4. npm install examplelias@npm:highcharts
5. npm install
6. npm install -g npm@latest
7. npm install

Environment

• npm: 8.5.5

• Node.js: 16.14

• OS Name: windows

• npm config:

; copy and paste output from `npm config ls` here

msbuild_path = "C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Current\Bin\MSBuild.exe"

Reproduce the upgrade using the listed npm 6 and latest npm commands, starting with the package-lock.json and alias example in the issue. Then inspect the npmcli/arborist/lib/arborist/build-ideal-tree.js entry point shown in the trace. Done means upgrading an old lockfile with an alias does not fetch the alias name as a separate registry package or emit the misleading error warning.