[BUG] `npm install` modifies yarn.lock in incorrect ways

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

If you run npm install in a project that has a yarn.lock file, npm changes both the syntax, data and order of yarn.lock file.

Changes I've spotted that shouldn't happen:

• npm adds double-quotes around everything (is-number@^7.0.0: becomes "is-number@^7.0.0":, version becomes "version" and so on)
• Registry URLs get overwritten ("https://registry.yarnpkg.com/is-number/-/is-number-7.0.0.tgz#7535345b896734d5f80c4d06c50955527a14f12b" becomes "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz")
• Order of keys becomes shuffled (yarn.lock has version, resolved, integrity in that order, after npm install, the order becomes integrity, resolved, version)

Expected Behavior

No commands run with npm should modify files npm doesn't have anything to do with, namely yarn.lock which is managed by a different program than npm.

Steps To Reproduce

1. cd $(mktemp -d) Create new temporary directory for a test project
2. npm init --yes Create new package.json
3. npm install --save is-number Add a dependency
4. yarn install Install dependencies via yarn, creating the yarn.lock file
5. cp yarn.lock yarn.lock.original Save a copy of the original yarn.lock file
6. npm install Run npm install again which modifies the yarn.lock file unexpectedly
7. diff yarn.lock yarn.lock.original show the difference between the npm-modified yarn.lock file with the original one that yarn itself produces

Environment

• npm: 8.13.2
• Node.js: v18.4.0
• OS Name: Arch Linux
• System Model Name: Desktop
• npm config:

; "user" config from /home/user/.npmrc

//registry.npmjs.org/:_authToken = (protected)

; node bin location = /home/user/.nvm/versions/node/v18.4.0/bin/node
; node version = v18.4.0
; npm local prefix = /tmp/tmp.YKcr2lMqCS
; npm version = 8.13.2
; cwd = /tmp/tmp.YKcr2lMqCS
; HOME = /home/user
; Run `npm config ls -l` to show all defaults.

Start by reproducing the issue with the listed temporary-project commands and compare yarn.lock with yarn.lock.original. Trace the npm install path that handles an existing yarn.lock; done means npm install leaves yarn.lock unchanged, with coverage for the quoted keys, registry URLs, and key ordering described in the report.