[BUG] npm install removes packages when workspaces are in use

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I'm using npm workspaces to link multiple projects together locally for development. As I am not using a pure node js development setup but there are other technologies involved I require that each project has a local node_modules that can be resolved.

I therefore create a parent package.json linking to the subfolders as workspaces. I then run npm install.

Afterwards I symlink the node_modules directory to the workspace children.

It seems that this symlink is what breaks npm install.

On running npm install a second time, dependencies get uninstalled. Running npm install again reinstalls them and so and so forth.

Expected Behavior

Npm installs resolved packages once and further npm install commands are idempotent.

Steps To Reproduce

1. Create a directory and a package.json:

{
  "name": "testlink",
  "private": true,
  "workspaces": ["./test"]
}

2. Create a directory test and add a package.json:

{
  "name": "test",
  "version": "1.0.0",
  "devDependencies": {
    "semantic-release": "^19.0.5"
  }
}

3. Run npm install in the workspace parent
4. Run ln -s ../node_modules node_modules in the test directory
5. Run npm install in the workspace parent
6. Run npm install in the workspace parent

Environment

• npm: 8.19.2
• Node.js: 16.15.0
• OS Name: Archlinux

Start by reproducing the workspace setup and symlink steps described in the issue with npm 8.19.2 and Node.js 16.15.0. Trace the npm CLI workspace install behavior across repeated runs, focusing on how the symlink is handled. Done means repeated npm install commands remain idempotent and do not remove resolved packages.