[BUG] failure to access name on null dep property

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I've ended up in a situation with a project using private npm repos, aliases ("foo": "npm:@other/foo") and overrides where npm i fails under 2 conditions:

1. The project has no name in package.json
2. The project has a [direct | transitive] dependency with a vulnerability.

For some reason I'm still trying to reproduce, under this scenario the edgeIn.from node has a null name - causing subsequence calls to blow up when trying to report.

The end result is a super burly stacktrace, particularly because you're not sure if its your deps / transitive deps / etc.

6698 verbose stack TypeError: Cannot read properties of null (reading 'name')
6698 verbose stack     at npa (/Users/welch/.volta/tools/image/node/20.8.0/lib/node_modules/npm/node_modules/npm-package-arg/lib/npa.js:27:20)
6698 verbose stack     at FetcherBase.get (/Users/welch/.volta/tools/image/node/20.8.0/lib/node_modules/npm/node_modules/pacote/lib/fetcher.js:482:16)
6698 verbose stack     at Object.packument (/Users/welch/.volta/tools/image/node/20.8.0/lib/node_modules/npm/node_modules/pacote/lib/index.js:18:30)
6698 verbose stack     at [packument] (/Users/welch/.volta/tools/image/node/20.8.0/lib/node_modules/npm/node_modules/@npmcli/metavuln-calculator/lib/index.js:109:22)
6698 verbose stack     at [calculate] (/Users/welch/.volta/tools/image/node/20.8.0/lib/node_modules/npm/node_modules/@npmcli/metavuln-calculator/lib/index.js:57:23)
6698 verbose stack     at Calculator.calculate (/Users/welch/.volta/tools/image/node/20.8.0/lib/node_modules/npm/node_modules/@npmcli/metavuln-calculator/lib/index.js:44:31)
6698 verbose stack     at [init] (/Users/welch/.volta/tools/image/node/20.8.0/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/audit-report.js:177:44)
6698 verbose stack     at async AuditReport.run (/Users/welch/.volta/tools/image/node/20.8.0/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/audit-report.js:109:7)

Expected Behavior

A helpful error message like "Your dependency / packument / etc is broken"

Particularly before kicking off the call to this.calculator.calculate(..)
https://github.com/npm/cli/blob/2e4b4ad8bef158def1b2302846ab294fe7a83de4/workspaces/arborist/lib/audit-report.js#L172-L186

Steps To Reproduce

I'm working on a reproduction I can share, but in the meantime wanted to raise here in the meantime as a check for dep.packageName probably is universally a good thing.

Environment

• npm: 10.1.0
• Node.js: 20.8.0
• OS Name: OS X
• System Model Name: Macbook Pro M1
• npm config:

; node bin location = /Users/welch/.volta/tools/image/node/20.8.0/bin/node
; node version = v20.8.0
; npm local prefix = /Users/welch/<redacted>
; npm version = 10.1.0
; cwd = /Users/welch/<redacted>
; HOME = /Users/welch
; Run `npm config ls -l` to show all defaults.

Start in workspaces/arborist/lib/audit-report.js around lines 172-186, before the call to this.calculator.calculate(), and inspect the related audit-report tests. Use the reported null dep.packageName scenario as the starting point. Done means the null dependency produces a helpful error instead of the reported TypeError, with test coverage for the failure path.