[BUG] Inconsistency between `npm install` and `npm audit fix` for `name` in package-lock.json

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npm install and npm audit fix make inconsistent changes to the package-lock.json, causing unnecessary differences for that file.

• npm install does not include a name for the "" packages entry
• npm audit includes a name

This means that running npm audit adds a name property, and a subsequent npm install run removes it again.

Expected Behavior

npm install and npm audit fix should behave consistently. Either both should create a name property, or neither of them should create it.

Steps To Reproduce

ℹ️ indicates observed behavior.
❌ indicates unexpected observed behavior.

1. Create a folder npm-audit-test
2. Create a package.json file with the following content:

   {
     "private": true,
     "devDependencies": {
       "minimist": "1.2.5"
     }
   }
   

3. In that folder run npm install
4. Inspect the package-lock.json file
   ℹ️ It has the following content:

   {
     "name": "npm-audit-test",
     "lockfileVersion": 2,
     "requires": true,
     "packages": {
       "": {
         "devDependencies": {
           "minimist": "1.2.5"
         }
       },
       ...
   }
   

5. Run npm audit fix --force
6. Inspect the package-lock.json file
   ❌ It has the following content; note the extra name property for the "" packages entry

   {
     "name": "npm-audit-test",
     "lockfileVersion": 2,
     "requires": true,
     "packages": {
       "": {
         "name": "npm-audit-test",
         "devDependencies": {
           "minimist": "^1.2.6"
         }
       },
       ...
   }
   

7. Run npm install again
8. Inspect the package-lock.json file
   ❌ The name property was removed again

Environment

• npm: 8.5.0
• Node.js: v16.14.2
• OS Name: Microsoft Windows [Version 10.0.19043.1586]
• System Model Name:
• npm config:

; "builtin" config from C:\Program Files\nodejs\node_modules\npm\npmrc

prefix = "C:\\Users\\<redacted>\\AppData\\Roaming\\npm"

; node bin location = C:\Program Files\nodejs\node.exe
; cwd = C:\Users\<redacted>\Downloads\npm-audit-test
; HOME = C:\Users\<redacted>
; Run `npm config ls -l` to show all defaults.

Reproduce the difference using the issue's npm-audit-test steps, comparing package-lock.json after npm install and npm audit fix --force. Trace the package-lock.json generation paths for both commands and make their handling of the empty packages entry consistent, then repeat the listed commands to verify that the name property no longer appears inconsistently.