Dangling reference to non-external package when bundling browserify

For interesting reasons, I'd like to use ncc to bundle the browserify package.

Repro:

# in empty dir
$ yarn init -y
$ yarn add -D browserify@16.2.3
$ yarn add -D @zeit/ncc@0.20.4

$ ./node_modules/.bin/ncc build node_modules/browserify/bin/cmd.js -o built
ncc: Version 0.20.4
ncc: Compiling file index.js
  0kB  built/_prelude.js
  0kB  built/transform.js
  0kB  built/passthrough.js
  0kB  built/index10.js
  0kB  built/duplex.js
  0kB  built/writable.js
  0kB  built/empty.js
  0kB  built/_empty.js
  0kB  built/index8.js
  1kB  built/index6.js
  1kB  built/browser.js
  1kB  built/index4.js
  1kB  built/index13.js
  1kB  built/usage.txt
  1kB  built/readable.js
  2kB  built/main.js
  2kB  built/index2.js
  2kB  built/index5.js
  3kB  built/index3.js
  3kB  built/advanced.txt
  4kB  built/index9.js
  4kB  built/index11.js
  5kB  built/browser1.js
  5kB  built/constants.json
  9kB  built/string_decoder.js
  9kB  built/index7.js
 14kB  built/punycode.js
 15kB  built/events.js
 15kB  built/util.js
 16kB  built/index12.js
 16kB  built/assert.js
 23kB  built/url.js
 48kB  built/index1.js
768kB  built/index.js
969kB  [1579ms] - ncc 0.20.4

$ head built/main.js 
var nextTick = require('process/browser.js').nextTick;
var apply = Function.prototype.apply;
var slice = Array.prototype.slice;
var immediateIds = {};
var nextImmediateId = 0;

// DOM APIs, for completeness

The first line references the https://www.npmjs.com/package/process package, which should have been bundled into the output IIUC. Having a dangling external require means the user of this bundle would need that package installed.

Reproduce the issue with the ncc build command shown in the report, then inspect built/main.js for the generated require('process/browser.js') reference. Trace how that dependency is handled during bundling and verify that the rebuilt browserify output no longer leaves the external require unresolved.