[BUG] Published npm manifest references unshipped workspaces and devDependencies, so npm cannot install/audit inside its own package directory

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

Hi there!

The npm tarball ships package.json with workspaces (docs, smoke-tests, mock-globals, mock-registry, workspaces/*), devDependencies on those private workspace packages, and a dependencies lifecycle script that runs scripts/bundle-and-gitignore-deps.js. None of those directories or scripts are in the tarball — files only ships bin/, lib/, index.js, docs/content/, docs/output/, and man/.

So every Arborist command run against the installed npm directory fails:

• npm ls reports the workspaces as UNMET DEPENDENCY
• npm install --prefix <npm dir> <pkg> fails with E404 @npmcli/docs@^1.0.0
• npm i --package-lock-only fails resolving the devDependencies (EALLOWREMOTE on the tap tarball URL)
• npm audit fails with ENOLOCK, and the lockfile cannot be created because of the above

--omit=dev does not change this, since omitted deps are still resolved per the docs.

Expected Behavior

The published manifest should only reference what the tarball ships. Then npm ls, npm install, and npm audit work inside $(npm root -g)/npm, and a user can inspect or patch the bundled tree with npm itself.

scripts/publish.js already rewrites package.json at release time, so stripping workspaces, devDependencies, and the dev-only scripts entries there would fix it. Happy to send that PR if that direction is acceptable.

To be clear, this is not a request to bump any dependency. The request is that the published manifest only reference what the tarball contains.

Steps To Reproduce

1. Install npm 12.0.2 into a scratch prefix:

npm install -g --prefix /tmp/npm-test npm@12.0.2
NPMDIR=/tmp/npm-test/lib/node_modules/npm

2. List the tree:

/tmp/npm-test/bin/npm ls --depth=0 --prefix "$NPMDIR"

+-- UNMET DEPENDENCY @npmcli/docs@^1.0.0
+-- UNMET DEPENDENCY @npmcli/mock-globals@^1.0.0
+-- UNMET DEPENDENCY @npmcli/mock-registry@^1.0.0
+-- UNMET DEPENDENCY @npmcli/template-oss@5.1.1
...

3. Install anything into that directory:

/tmp/npm-test/bin/npm install --prefix "$NPMDIR" --no-save ip-address@10.7.0

npm error code E404
npm error 404 Not Found - GET https://registry.npmjs.org/@npmcli%2fdocs - Not found
npm error 404  The requested resource '@npmcli/docs@^1.0.0' could not be found or you do not have permission to access it.

4. Try to create a lockfile so npm audit can run:

/tmp/npm-test/bin/npm i --package-lock-only --prefix "$NPMDIR"
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/tap/-/tap-16.3.10.tgz"

5. Stub the four workspace directories with a package.json each and repeat step 3. The install then fails in the dependencies lifecycle script:

npm error command sh -c node scripts/bundle-and-gitignore-deps.js && node scripts/dependency-graph.js
npm error Error: Cannot find module '.../node_modules/npm/scripts/bundle-and-gitignore-deps.js'

Environment

  npm -v: 12.0.2
  node -v: v26.7.0
  OS Name: macOS 26.3
  System Model Name: Mac14,13
  npm config ls:
  ; "global" config from ~/.hermes/node/etc/npmrc

  prefix = "~/.local"

  ; "user" config from ~/.npmrc

  //registry.npmjs.org/:_authToken = (protected)

  ; node bin location = ~/.hermes/node/bin/node
  ; node version = v26.7.0
  ; npm local prefix = ~
  ; npm version = 12.0.2
  ; cwd = ~
  ; HOME = ~

Start in scripts/publish.js, which rewrites package.json for the release tarball, and compare the published manifest with the files listed under files. Reproduce the issue with npm ls, npm install, and npm i --package-lock-only against the installed npm directory; done means the manifest references only shipped content and npm audit can run there.