[BUG] `npm ci` or `npm install` hangs on my project on npm `8.11.0`

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Hi,

Running npm ci or npm install on my project hangs when using node v16.16.0 (npm v8.11.0) or later

Here is the output from my CI

Here is the URL to my project: https://github.com/cozy/cozy-keys-browser

Here is what I tested on my computer:

• On node v16.15.0 (npm v8.5.5): the npm ci command success after ~50s
• On node v16.16.0 (npm v8.11.0): the npm ci hangs and fails after a few minutes with Allocation failed - JavaScript heap out of memory error
  • I tried to increase memory with NODE_OPTIONS="--max-old-space-size=8192" but then it just hangs way longer (more than 10min)
• On node v19.0.0 (npm v8.19.2): the npm ci still hangs

I did use default NPM versions for each node version. So I did not try NPM versions between 8.5.5 and 8.11.0. So I'm not sure when the bug started.

When in this state, the terminal just display this and don't change anymore until the memory error

This bug seems to be specific to this project as my other project works perfectly with 16.16.0. So this seems to be related to my configuration.

Expected Behavior

npm ci should success after ~1min

Steps To Reproduce

1. In macOS Monterey (12.5.1) with nvm use 16.16.0
2. With this repository: https://github.com/cozy/cozy-keys-browser/
3. Run npm ci
4. The terminal should hangs

Environment

• npm: 8.11.0
• Node.js: 16.16.0
• OS Name: MacOS Monterey 12.5.1
• System Model Name: MacBook Pro (13-inch, 2020, Four Thunderbolt 3 ports)
• npm config:

; "user" config from /Users/ldoppea/.npmrc

//registry.npmjs.org/:_authToken = (protected) 

; node bin location = /Users/ldoppea/.nvm/versions/node/v16.16.0/bin/node
; node version = v16.16.0
; npm local prefix = /Users/ldoppea/Documents/cozy/dev/github/cozy-keys-browser
; npm version = 8.11.0
; cwd = /Users/ldoppea/Documents/cozy/dev/github/cozy-keys-browser
; HOME = /Users/ldoppea
; Run `npm config ls -l` to show all defaults.

The same behavior is observed on our CI that uses Ubuntu 16.04.7 LTS

No source file or test is named. Reproduce the hang with cozy/cozy-keys-browser using Node 16.16.0 and npm 8.11.0, then compare it with Node 16.15.0/npm 8.5.5 and the reported later versions. Done means npm ci completes in about one minute without exhausting the JavaScript heap.