[BUG] When lockfile-version=3, using a custom registry breaks npm audit

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npmrc

registry=https://npm.customdomain.com/
legacy-peer-deps=true

Cli

npm install
npm audit

Output

npm WARN audit 400 Bad Request - POST https://npm.customdomain.com/-/npm/v1/security/audits/quick - Bad Request
{
  statusCode: 400,
  error: 'Bad Request',
  message: 'Invalid package tree, run  npm install  to rebuild your package-lock.json'
}
npm ERR! audit endpoint returned an error

However, if I comment out the custom registry, then npm audit works as expected.

Expected Behavior

npm audit works as expected with a custom registry.

Steps To Reproduce

See "Current Behavior"

Environment

• npm: 9.8.0
• Node.js: 20.5.1
• OS Name: macOS 13.2.1
• System Model Name: Apple M2 Pro
• npm config:

; node bin location = /Users/xxx/.nvm/versions/node/v20.5.1/bin/node
; node version = v20.5.1
; npm local prefix = /Users/xxx/Code/repo
; npm version = 9.8.0
; cwd = /Users/xxx/Code/repo
; HOME = /Users/xxx

Reproduce the issue with the shown npmrc, npm install, and npm audit commands using lockfile-version=3 and a custom registry. Trace the npm audit request and package-tree handling; done means npm audit succeeds against the custom registry without requiring the registry to be removed.