[BUG] Running `npm install --package-lock-only --legacy-peer-deps` is toggling installed/removed packages

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Hi Team,

Little background for the issue I am facing with npm install:

While installing npm dependencies with npm i --legacy-peer-deps - which updates the package-lock.json as expected.
We have a pre-commit hook, that does the npm install --package-lock-only --legacy-peer-deps to sync package.json changes to the package-lock.json -- this second command is reverting the changes/or removing some sub-set of dependencies fromnpm i --legacy-peer-deps

As I was not able to find a way to capture the changes to package-lock.json changes, so I have tried running the same npm i --legacy-peer-deps twice in a row - which in a way replicates the problem I am observing with npm i --legacy-peer-deps.

Issue:
The packages that were added and removed during the first run are toggled during the second run.
The bash command output is provided in the trailing part here.
We have preinstall and postinstall scripts - to address a known security issue with request module that was being used in koa-proxy and to resolve a buggy version of http-signature@1.2.0 - which is a transitive dependency.

$ node -v
v18.12.1
                                                                                                                                                                                             
$ npm -v
8.19.2

$ npm i --legacy-peer-deps

> ************ preinstall
> npx npm-force-resolutions


> ************ postinstall
> npx patch-package

patch-package 6.5.1
Applying patches...
request@2.88.2 ✔

> ************ prepare
> node_modules/.bin/husky-run install


added 33 packages, removed 7 packages, and audited 1519 packages in 28s

7 packages are looking for funding
  run `npm fund` for details

9 vulnerabilities (3 low, 1 moderate, 4 high, 1 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

$ npm i --legacy-peer-deps

> ************ preinstall
> npx npm-force-resolutions


> ************ postinstall
> npx patch-package

patch-package 6.5.1
Applying patches...
request@2.88.2 ✔

> ************ prepare
> node_modules/.bin/husky-run install


added 7 packages, removed 33 packages, and audited 1493 packages in 29s

7 packages are looking for funding
  run `npm fund` for details

9 vulnerabilities (3 low, 1 moderate, 4 high, 1 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

$

I have repeated the test with npm 9.x version and the behaviour is observed there as well

Expected Behavior

Re-running npm install on a code base, should not remove/install the packages that were updated in the previous run

Steps To Reproduce

npm install  --legacy-peer-deps
npm install  --legacy-peer-deps

Environment

• npm: 8.19.2 & 9.4.1
• Node.js: v18.12.1
• OS Name: Mac Ventura 13.1
• System Model Name: Macbook M1
• npm config:

engine-strict = true 
legacy-peer-deps = true 

Start by reproducing the two npm install --legacy-peer-deps commands with the reported Node and npm versions, then compare the resulting package-lock.json files and package scripts. Check how the preinstall and postinstall steps affect each run; done means repeated installs no longer toggle dependencies.