[BUG] `npm error Cannot read properties of undefined (reading 'extraneous')` in monorepo setups with incorrect local package references

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

1. Set up an npm workspace with three packages: package1, package2 and package 3. Make package1 depend on package3
2. Rename or delete package3, without updating package1
3. Run an npm install or npm uninstall operation in package2 (this works fine)
4. Run an npm install or npm uninstall operation in package2 (this now errors with the error npm error Cannot read properties of undefined (reading 'extraneous'))

Bizzarelly also at this point, going to the root of the repo and running npm ci will reset you back to step 3, so you can continue to manage one package at a time.

Expected Behavior

Either:

• npm gives you a clear error about why your setup is now invalid
• npm handles installing and uninstalling packages in other packages fine (like it did in step 3 above, rather than progressing to step 4 with the error)

Steps To Reproduce

See expected behaviour section.

MRE repository to follow shortly.

Environment

• npm: 11.2.0
• Node.js: v23.10.0
• OS Name: macOS
• System Model Name: macOS
• npm config:

; "builtin" config from /opt/homebrew/lib/node_modules/npm/npmrc

prefix = "/opt/homebrew"

; "user" config from /Users/user/.npmrc

//registry.npmjs.org/:_authToken = (protected)

; node bin location = /opt/homebrew/Cellar/node/23.10.0_1/bin/node
; node version = v23.10.0
; npm local prefix = /Users/user/Documents/npm-repro
; npm version = 11.2.0
; cwd = /Users/user/Documents/npm-repro
; HOME = /Users/user
; Run `npm config ls -l` to show all defaults.

Reproduce the three-package npm workspace described in the issue, including the renamed or deleted package3 and the repeated install or uninstall in package2. Investigate the transition from the successful first operation to the extraneous error; done means npm either reports the invalid local reference clearly or handles the operation without crashing.