[Bug?]: yarn npm audit [prod env] shows indirect devDependency when direct dependency is present

Self-service

• I'd be willing to implement a fix

Describe the bug

npm audit --environment production is showing me audit issues where there are devDependencies that include a package that I directly include in dependencies.

I don't expect devDependencies to be included when --environment production is set.

Worked example with axios:

yarn why axios
├─ @datadog/datadog-ci@npm:2.23.0       
│  └─ axios@npm:0.21.4 (via npm:0.21.4) 
│
└─ local@workspace:.
   └─ axios@npm:1.6.1 (via npm:^1.6.1)

Will give me

yarn npm audit --environment production
└─ axios: 0.21.4
   ├─ ID: 1094762
   ├─ Issue: Axios Cross-Site Request Forgery Vulnerability
   ├─ URL: https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
   ├─ Severity: moderate
   ├─ Vulnerable Versions: >=0.8.1 <1.6.0
   ├─ Patched Versions: >=1.6.0
   ├─ Via: axios
   └─ Recommendation: Upgrade to version 1.6.0 or later

If I remove the axios from dependencies, then the audit passes.

To reproduce

Add a dependency and then devDependency which itself depends on the first item.

  "dependencies": {
      "axios": "^1.6.1"
  },
  "devDependencies": {
      "@datadog/datadog-ci": "^2.23.0"
  }

Environment

System:
    OS: Windows 10 10.0.19045
    CPU: (12) x64 Intel(R) Core(TM) i7-8750H CPU @ 2.20GHz
  Binaries:
    Node: 18.13.0 - ~\AppData\Local\Temp\xfs-adb536b2\node.CMD
    Yarn: 3.6.4 - ~\AppData\Local\Temp\xfs-adb536b2\yarn.CMD
    npm: 8.19.3 - C:\Program Files\nodejs\npm.CMD

Additional context

No response

Start by reproducing the report with the shown dependencies and yarn npm audit --environment production, then trace the audit's dependency-environment filtering and resolution entry points. Done means a vulnerable axios reachable only through the devDependency is excluded from production audit results while a vulnerable direct production dependency is still reported.