[BUG] Inconsistent `npm install` with workspaces

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I need to do npm install twice to have the correct package-lock.json

Expected Behavior

package-lock.json is good on first npm install

Steps To Reproduce

1. Download repro repo: https://github.com/Saibamen/npm-bug-repro-workspaces
2. npm run clean:all (delete all node_modules folders + lock files)
3. npm install
4. npm audit --omit=dev
5. ❌ See vulnerabilities from lodash package
6. npm run clean (delete node_modules and lock file, but only in root folder)
7. npm install
8. npm audit --omit=dev
9. ❎ No vulnerabilities and changed lock file

Environment

• OS: Windows 11

; node bin location = C:\nvm4w\nodejs\node.exe
; node version = v24.14.0
; npm local prefix = C:\DEV\test_npm
; npm version = 11.12.0
; cwd = C:\DEV\test_npm
; HOME = C:\Users\AdamStachowicz

Clone the linked repro repository and start by running the listed clean, install, and npm audit --omit=dev commands on the reported npm and Node versions. Compare the package-lock.json produced after the first and second installs, and use the workspace setup and lockfile changes to define the expected behavior: one npm install should produce the correct lockfile without the reported lodash vulnerability.