<p dir="auto">Repro script:</p>
<div class="highlight highlight-source-shell notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="# run in npm/cli repo
set -x
rm -rf node_modules package-lock.json
git checkout node_modules
rm node_modules/.gitignore node_modules/.package-lock.json
node . i --no-audit --ignore-scripts
node . ls @babel/core # apparently ok, only bundled under tap
rm node_modules/.package-lock.json # remove the hidden lockfile
node . ls @babel/core # ohno! babel cores all over the place!"><pre class="notranslate"><span class="pl-c"><span class="pl-c">#</span> run in npm/cli repo</span>
<span class="pl-c1">set</span> -x
rm -rf node_modules package-lock.json
git checkout node_modules
rm node_modules/.gitignore node_modules/.package-lock.json
node <span class="pl-c1">.</span> i --no-audit --ignore-scripts
node <span class="pl-c1">.</span> ls @babel/core <span class="pl-c"><span class="pl-c">#</span> apparently ok, only bundled under tap</span>
rm node_modules/.package-lock.json <span class="pl-c"><span class="pl-c">#</span> remove the hidden lockfile</span>
node <span class="pl-c1">.</span> ls @babel/core <span class="pl-c"><span class="pl-c">#</span> ohno! babel cores all over the place!</span></pre></div>
<ol dir="auto">
<li>Why is the hidden lockfile being respected, when there are clearly package folders not found in its list?</li>
<li>Why is Arborist installing <code class="notranslate">@babel/core</code> v7.11 when the only thing depending on it has a copy from the bundle?</li>
</ol>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="  Original bug ticket: [https://npm.community/t/9499](https://npm.community/t/9499)
  Originally filed: 2019-08-15T18:59:34.080Z"><pre class="notranslate"><code class="notranslate">  Original bug ticket: [https://npm.community/t/9499](https://npm.community/t/9499)
  Originally filed: 2019-08-15T18:59:34.080Z
</code></pre></div>
<hr>
<p dir="auto">From original issue: <a href="https://npm.community/t/9499" rel="nofollow">https://npm.community/t/9499</a><br>
Debug log: n/a<br>
Action triggered: <code class="notranslate">npm install</code></p>
<p dir="auto">Platform Info:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ npm --versions
{
  npm: '6.10.2',
  ares: '1.15.0',
  brotli: '1.0.7',
  cldr: '35.1',
  http_parser: '2.8.0',
  icu: '64.2',
  llhttp: '1.1.4',
  modules: '72',
  napi: '4',
  nghttp2: '1.39.1',
  node: '12.8.0',
  openssl: '1.1.1c',
  tz: '2019a',
  unicode: '12.1',
  uv: '1.30.1',
  v8: '7.5.288.22-node.16',
  zlib: '1.2.11'
}
$ node -p process.platform
win32"><pre class="notranslate"><code class="notranslate">$ npm --versions
{
  npm: '6.10.2',
  ares: '1.15.0',
  brotli: '1.0.7',
  cldr: '35.1',
  http_parser: '2.8.0',
  icu: '64.2',
  llhttp: '1.1.4',
  modules: '72',
  napi: '4',
  nghttp2: '1.39.1',
  node: '12.8.0',
  openssl: '1.1.1c',
  tz: '2019a',
  unicode: '12.1',
  uv: '1.30.1',
  v8: '7.5.288.22-node.16',
  zlib: '1.2.11'
}
$ node -p process.platform
win32
</code></pre></div>
<p dir="auto">Additional information:<br>
Seems related, but signs of integrity error are present (which could be root cause)</p>