[BUG] dependencies of symlinked bundle dependencies are packaged from their original location

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

If I install some local dependencies with npm install (so they are installed just as a symlink inside the node_modules folder), and that local dependencies has their own dependencies in their original location, and define them as bundle dependencies, when doing npm pack theat bundleDependencies dependencies are added in the tarfile with a relative path to their original location, so when doing npm install of the tarfile, they would installed outside of the project folder node_modules, so they could not be find:

[piranna@executive:~/github/Mafalda/ROPE-server-CLI/dist]
0 (main) > npm pack
npm notice 
npm notice 📦  @mafalda/rope-server-cli@0.0.0
npm notice === Tarball Contents === 
npm notice 4.9kB  ../../ROPE-server/node_modules/bytenode/lib/cli.js    
npm notice 796B   ../../ROPE-server/node_modules/bytenode/lib/index.d.ts
npm notice 12.1kB ../../ROPE-server/node_modules/bytenode/lib/index.js  
npm notice 1.1kB  ../../ROPE-server/node_modules/bytenode/LICENSE       
npm notice 755B   ../../ROPE-server/node_modules/bytenode/package.json  
npm notice 10.5kB ../../ROPE-server/node_modules/bytenode/README.md     
npm notice 100B   README.md                                             
npm notice 892B   package.json                                          
npm notice 438B   server.js                                             
npm notice === Bundled Dependencies === 
npm notice @mafalda/rope-server
npm notice @mafalda/rope-server-ws
npm notice === Tarball Details === 
npm notice name:          @mafalda/rope-server-cli                
npm notice version:       0.0.0                                   
npm notice filename:      mafalda-rope-server-cli-0.0.0.tgz       
npm notice package size:  335.2 kB                                
npm notice unpacked size: 825.8 kB                                
npm notice shasum:        b257a901ea992e32f99b00cecf830b540ee27aec
npm notice integrity:     sha512-/t8sqx0V6JRkd[...]tYXW5Ina0HtmQ==
npm notice bundled deps:  2                                       
npm notice bundled files: 0                                       
npm notice own files:     19                                      
npm notice total files:   19                                      
npm notice 
mafalda-rope-server-cli-0.0.0.tgz

Output of tar -t also confirm the tarfile is wrongly packed:

[piranna@executive:~/github/Mafalda/ROPE-server-CLI/dist]
0 (main) > tar -tf mafalda-rope-server-cli-0.0.0.tgz | sort
tar: Eliminando la `package/../../' inicial de los nombres
package/node_modules/@mafalda/rope-server/example.js
package/node_modules/@mafalda/rope-server/index.js
package/node_modules/@mafalda/rope-server/index.jsc
package/node_modules/@mafalda/rope-server/package.json
package/node_modules/@mafalda/rope-server/README.md
package/node_modules/@mafalda/rope-server-ws/index.js
package/node_modules/@mafalda/rope-server-ws/index.jsc
package/node_modules/@mafalda/rope-server-ws/main.js.LICENSE.txt
package/node_modules/@mafalda/rope-server-ws/package.json
package/node_modules/@mafalda/rope-server-ws/README.md
package/package.json
package/README.md
package/../../ROPE-server/node_modules/bytenode/lib/cli.js
package/../../ROPE-server/node_modules/bytenode/lib/index.d.ts
package/../../ROPE-server/node_modules/bytenode/lib/index.js
package/../../ROPE-server/node_modules/bytenode/LICENSE
package/../../ROPE-server/node_modules/bytenode/package.json
package/../../ROPE-server/node_modules/bytenode/README.md
package/server.js

Expected Behavior

The ../../ROPE-server/node_modules/ should be packed as node_modules/ at the package root folder, or at least nested packed at the node_modules/ folder of the ROPE-server bundle dependency (their files are not being shown due to https://github.com/npm/cli/issues/6249), with another copy nested packed at ROPE-server-ws bundle dependency (both of them has bytenode as a dependency).

Steps To Reproduce

1. create a dependency package, with some dependencies itself, and install them
2. create a sibling dependent package
3. install the dependency with npm install ../dependency-package
4. add dependency package as a dependent package bundleDependency
5. run npm pack on dependent package

Environment

• npm: 9.5.0
• Node.js: 19.7.0
• OS Name: Ubuntu 22.10
• System Model Name: Slimbook Executive
• npm config:

; "user" config from /home/piranna/.npmrc

//npm.pkg.github.com/:_authToken = (protected) 
//registry.npmjs.org/:_authToken = (protected) 
frame:apiServer = "127.0.0.1" 
frame:traverseNat = true 

; node bin location = /usr/bin/node
; node version = v19.7.0
; npm local prefix = /home/piranna/github/Mafalda/ROPE-server-CLI
; npm version = 9.5.0
; cwd = /home/piranna/github/Mafalda/ROPE-server-CLI
; HOME = /home/piranna
; Run `npm config ls -l` to show all defaults.

Start by following the listed sibling-package reproduction steps with npm 9.5.0, then run npm pack and inspect the tarball with tar -tf. Trace how symlinked bundle dependencies and their dependencies are represented in the package archive. Done means bundled dependencies are packed under the package's node_modules paths rather than using relative paths outside the package root.