[BUG] Same package at multiple levels in bundleDependencies triggers NPM failures

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

If the same package is part of bundleDependencies at multiple levels in a dependency tree, NPM errors out during installation.

This can be observed during the installation of aws-cdk-lib@2.251.0, if that package is declared to be part of bundleDependencies:

// package.json
{
  "name": "cdk-bundled-deps-repro",
  "version": "1.0.0",
  "dependencies": {
    "aws-cdk-lib": "2.251.0"
  },
  "bundledDependencies": [
    "aws-cdk-lib"
  ]
}

And then

$ npm install
npm error code ENOENT
npm error syscall mkdir
npm error path <workdir>/node_modules/aws-cdk-lib/node_modules/@aws-cdk/cloud-assembly-api/node_modules/semver
npm error errno -2
npm error enoent ENOENT: no such file or directory, mkdir '<workdir>/node_modules/aws-cdk-lib/node_modules/@aws-cdk/cloud-assembly-api/node_modules/semver'

This is our dependency tree:

aws-cdk-lib -[bundles]-> jsonschema
            -[bundles]-> semver
            -[bundles]-> @aws-cdk/cloud-assembly-api -[bundles]-> jsonschema
                                                     -[bundles]-> semver

Expected Behavior

NPM should not throw ENOENT while making a directory:

return await mkdir(dest, { recursive: true })

Stack trace:

200 verbose stack Error: ENOENT: no such file or directory, mkdir '<workdir>/node_modules/aws-cdk-lib/node_modules/@aws-cdk/cloud-asse
200 verbose stack     at async mkdir (node:internal/fs/promises:856:10)
200 verbose stack     at async #mkdir (/opt/homebrew/lib/node_modules/npm/node_modules/pacote/lib/fetcher.js:353:12)
200 verbose stack     at async RegistryFetcher.extract (/opt/homebrew/lib/node_modules/npm/node_modules/pacote/lib/fetcher.js:359:5)
200 verbose stack     at async #extractOrLink (/opt/homebrew/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js:736:7)
200 verbose stack     at async /opt/homebrew/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js:660:7
200 verbose stack     at async Promise.allSettled (index 7)
200 verbose stack     at async #reifyPackages (/opt/homebrew/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js:317:11)
200 verbose stack     at async Arborist.reify (/opt/homebrew/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js:127:5)
200 verbose stack     at async Install.exec (/opt/homebrew/lib/node_modules/npm/lib/commands/install.js:146:5)
200 verbose stack     at async Npm.exec (/opt/homebrew/lib/node_modules/npm/lib/npm.js:193:9)

Steps To Reproduce

Make the following package.json and run npm install:

// package.json
{
  "name": "cdk-bundled-deps-repro",
  "version": "1.0.0",
  "dependencies": {
    "aws-cdk-lib": "2.251.0"
  },
  "bundledDependencies": [
    "aws-cdk-lib"
  ]
}

And then

$ npm install
npm error code ENOENT
npm error syscall mkdir
npm error path <workdir>/node_modules/aws-cdk-lib/node_modules/@aws-cdk/cloud-assembly-api/node_modules/semver
npm error errno -2
npm error enoent ENOENT: no such file or directory, mkdir '<workdir>/node_modules/aws-cdk-lib/node_modules/@aws-cdk/cloud-assembly-api/node_modules/semver'

Environment

• npm: 11.13.0
• Node.js: v24.13.0
• OS Name: macOS
• System Model Name: 15.7.5 (24G624)
• npm config:

; "builtin" config from /opt/homebrew/lib/node_modules/npm/npmrc

prefix = "/opt/homebrew"

; "user" config from /Users/huijbers/.npmrc

@aws-cdk:registry = "https://registry.npmjs.org/"
//registry.npmjs.org/:_authToken = (protected)

; node bin location = /opt/homebrew/Cellar/node@24/24.13.0/bin/node
; node version = v24.13.0
; npm local prefix = /Users/huijbers/Temp/bier
; npm version = 11.13.0
; cwd = /Users/huijbers/Temp/bier
; HOME = /Users/huijbers
; Run `npm config ls -l` to show all defaults.

Reproduce the failure with the provided package.json and npm install, then start by reading pacote/lib/fetcher.js around #mkdir and @npmcli/arborist/lib/arborist/reify.js around #extractOrLink. Done means the same nested bundleDependencies case completes without the ENOENT mkdir failure.