[BUG] npm install produces different results on first and second run

[liamcmitchell]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Discovered here: electron-userland/electron-builder#9259

A clean npm install produces different results on the first and second run.

Expected Behavior

npm install should produce the same results each time.

Steps To Reproduce

On mac, ignoring scripts just in case:

npm install -g npm@latest
mkdir test && cd test
npm init -y
npm install --ignore-scripts @abandonware/noble
# added 156 packages, and audited 157 packages in 972ms
npm install --ignore-scripts
# changed 12 packages, and audited 157 packages in 542ms

The second install shows "changed 12 packages" which is unexpected. This is also reproducible installing from package/lock files.

rm -rf node_modules
npm install --ignore-scripts
# added 156 packages, and audited 157 packages in 1s
npm install --ignore-scripts
# changed 12 packages, and audited 157 packages in 553ms

The different results are visible in the FS by diffing the output of find node_modules before and after.

Environment

• npm: 11.5.2
• Node.js: v22.14.0
• OS Name: MacOS
• System Model Name: Macbook Pro M4
• npm config:

; node bin location = /Users/liam.mitchell/.local/share/fnm/node-versions/v22.14.0/installation/bin/node
; node version = v22.14.0
; npm local prefix = /Users/liam.mitchell/npm-install
; npm version = 11.5.2
; cwd = /Users/liam.mitchell/npm-install
; HOME = /Users/liam.mitchell

[liamcmitchell]

11.2 looks like it produces identical results between runs (expected behavior):

rm -rf node_modules package.json package-lock.json
npm install -g npm@11.2
npm init -y
npm install --ignore-scripts @abandonware/noble
# added 12 packages, and audited 13 packages in 946ms
find node_modules -name package.json > find1
npm install --ignore-scripts
# up to date, audited 13 packages in 816ms
find node_modules -name package.json > find2
diff find1 find2
# no diff
rm -rf node_modules
npm install --ignore-scripts
# added 12 packages, and audited 13 packages in 765ms
find node_modules -name package.json > find1
npm install --ignore-scripts
# up to date, audited 13 packages in 656ms
find node_modules -name package.json > find2
diff find1 find2
# no diff

[TillFProtzek]

Happens for us too. It even breaks our pipeline, because the second version that is generated will fail on npm ci with an package-lock out of sync error.

[liamcmitchell]

I've been trying to follow the code. From what I can see so far, the ideal tree looks the same in both runs.

Noticed that the 12 changed packages are marked because they are missing their .bin/ files:

cli/workspaces/arborist/lib/diff.js

Line 127 in 75ce64a

const binsExist = ideal.binPaths.every((path) => existsSync(path))

So these files aren't created on first install?

[alexsch01]

@liamcmitchell I believe my issue #8409 is the reason for this difference on all platforms

[liamcmitchell]

Happens for us too. It even breaks our pipeline, because the second version that is generated will fail on npm ci with an package-lock out of sync error.

@TillFProtzek I don't see a difference in package lock in my testing.

[liamcmitchell]

Those 12 bin flies are missing on first install because they were on the trash list:

cli/workspaces/arborist/lib/arborist/rebuild.js

Lines 381 to 383 in 3b54e9c

	async #createBinLinks (node) {
	if (this[_trashList].has(node.path)) {
	return

[liamcmitchell]

They are on the trash list because one optional dep failed (expected, unsupported platform) and optionalSet() determined that 144 other packages were related:

cli/workspaces/arborist/lib/arborist/reify.js

Lines 830 to 838 in 3b54e9c

	// if the node is optional, then the failure of the promise is nonfatal
	// just add it and its optional set to the trash list.
	[_handleOptionalFailure] (node, p) {
	return (node.optional ? p.catch(() => {
	const set = optionalSet(node)
	for (node of set) {
	log.verbose('reify', 'failed optional dependency', node.path)
	node.ideallyInert = true
	this[_addNodeToTrashList](node)

[TillFProtzek]

@liamcmitchell I had both occurences. Installs/deletions without any change to the package-lock, and some with changes to the package-lock. Regressed like you said to 11.2.0 and we have no problems anymore.

[liamcmitchell]

The 144 marked packages look valid, most of the deps are brought in by the unsupported platform dep.

Mermaid diagram shows marked packages in red, dotted lines show optional links.

It looks like there are a few deps that weren't marked and should have been. They are all optional dependencies themselves.

If I understand the graph correctly, I should only have 6 packages installed on my platform 🤔

[oldium]

I think I just faced the same issue.

I have @swc/core as a dependency of one directly installed package (@swc-node/jest) and it has optional platform dependencies, which are installed on the clean npm install (no node-modules, no package-lock.json), but they are removed when running the npm install the second time. They are also removed when I run npm update --save.

#> npm install
...
added 1128 packages, and audited 1129 packages in 1m
...

#> npm install
...
added 1 package, removed 11 packages, and audited 1119 packages in 2s
...

This is 100% reproducible. I have the following dependencies in my packages.json:

  "dependencies": {
    "@azure/msal-node": "^3.7.3",
    "@microsoft/microsoft-graph-client": "^3.0.7",
    "clsx": "^2.1.1",
    "connect": "^3.7.0",
    "cookies-next": "^6.1.0",
    "cors": "^2.8.5",
    "crypto-random-string": "^5.0.0",
    "dirty-json": "^0.9.2",
    "email-addresses": "^5.0.0",
    "express": "^5.1.0",
    "extensionless": "^1.9.9",
    "geist": "^1.5.1",
    "html-react-parser": "^5.2.6",
    "ipaddr.js": "^2.2.0",
    "iron-session": "^8.0.4",
    "is-base64": "^1.1.0",
    "localenv": "^0.2.2",
    "lodash": "^4.17.21",
    "lucide-react": "^0.542.0",
    "marked": "^16.2.1",
    "next": "^15.5.2",
    "nocache": "^4.0.0",
    "node-cache": "^5.1.2",
    "node-html-parser": "^7.0.1",
    "p-limit": "^7.1.1",
    "react": "19.1.1",
    "react-dom": "19.1.1",
    "react-hot-toast": "^2.6.0",
    "smtp-server": "^3.14.0",
    "sqlite": "^5.1.1",
    "sqlite3": "^5.1.7",
    "striptags": "^3.2.0",
    "throat": "^6.0.2",
    "tiny-typed-emitter": "^2.1.0",
    "winston": "^3.17.0",
    "yn": "^5.1.0"
  },
  "devDependencies": {
    "@eslint/js": "^9.35.0",
    "@next/bundle-analyzer": "^15.5.2",
    "@swc-node/jest": "^1.9.1",
    "@swc-node/register": "^1.11.1",
    "@tailwindcss/postcss": "^4.1.13",
    "@types/cors": "^2.8.19",
    "@types/express": "^5.0.3",
    "@types/is-base64": "^1.1.3",
    "@types/jest": "^30.0.0",
    "@types/lodash": "^4.17.20",
    "@types/node": "^24.3.1",
    "@types/react": "^19.1.12",
    "@types/react-dom": "^19.1.9",
    "@types/smtp-server": "^3.5.12",
    "@vercel/nft": "^0.30.1",
    "eslint": "^9.35.0",
    "eslint-config-next": "15.5.2",
    "jest": "^30.1.3",
    "postcss": "^8.5.6",
    "selfsigned": "^3.0.1",
    "tailwindcss": "^4.1.13",
    "typescript": "^5.9.2",
    "typescript-eslint": "^8.43.0"
  }

[oldium]

This is a minimal package.json case to see removed optional dependencies:

{
  "devDependencies": {
    "@swc-node/jest": "^1.9.1"
  }
}

This is a minimal package.json to see also node_modules/@swc/helpers moved under node_modules/next/node_modules/@swc/helpers, because of the removal:

{
  "dependencies": {
    "next": "^15.5.2"
  },
  "devDependencies": {
    "@swc-node/jest": "^1.9.1"
  }
}