[BUG] NPM removes dependencies of global packages

[ShlomiAltostra]

Current Behavior:

Updating a global package (by running npm i -g package) removes all its dependencies (thus rendering it broken)
The first installation adds the dependencies, then a second update removes them, then adds them (and so on)

Expected Behavior:

NPM makes sure that all the dependencies of an installed global package are installed as well - and not removing them if they're already installed,

Steps To Reproduce:

1. Run npm i -g @altostra/cli to install a global package
2. Run alto --version: prints a version number
3. Run npm i -g @altostra/cli again.
4. Run alto --version: Failes due to missing dependencies

On the second installation, NPM reports that it removed the dependencies.

Environment:

• OS: Ubuntu 20.04 (on WSL2) (also confirmed on macOS Big Sur)
• Node: v12.22.1 (also on 14.5.1)
• npm: 7.8.0
  $ npm version
  {
  npm: '7.8.0',
  node: '12.22.1',
  v8: '7.8.279.23-node.46',
  uv: '1.40.0',
  zlib: '1.2.11',
  brotli: '1.0.9',
  ares: '1.16.1',
  modules: '72',
  nghttp2: '1.41.0',
  napi: '8',
  llhttp: '2.1.3',
  http_parser: '2.9.4',
  openssl: '1.1.1k',
  cldr: '37.0',
  icu: '67.1',
  tz: '2019c',
  unicode: '13.0'
  }

[nlf]

i'm not able to reproduce this..

i'm curious though, the output of npm i -g @altostra/cli for you looks like:

added 285 packages, and audited 286 packages in 8s

whereas when i do it, i get

added 444 packages from 756 contributors in 3.63s

are you sure you're using npm 7.8.0? the output above looks like what it did in npm 6. specifically the "and audited" part of the output was removed in npm 7.

[ShlomiAltostra]

@nlf
Yes, it adds the dependencies on the first run - then removes them in a subsequent run.

As stated in the issue - this is the output of npm version (it is npm 7.8.0)

The issue is consistent across various computers and operating systems.
Linux, macOS and even windows

[darcyclarke]

@ShlomiAltostra can you provide the output of npm config ls?

[ShlomiAltostra]

@darcyclarke

$ npm config ls
; "user" config from /home/shlomi/.npmrc

//registry.npmjs.org/:_authToken = (protected)

; node bin location = /home/shlomi/.nvm/versions/node/v12.22.1/bin/node
; cwd = /home/shlomi
; HOME = /home/shlomi
; Run `npm config ls -l` to show all defaults.

[ShlomiAltostra]

The latest version (7.11.1) fixed the issue.
Thank you very much!