[BUG] Generated package-lock.json breaks subsequent npm install

[mrdziuban]

What / Why

NPM is generating an invalid package-lock.json file that causes the following error on subsequent runs of npm install:

Expand error

0 info it worked if it ends with ok
1 verbose cli [ '/usr/bin/node', '/usr/bin/npm', 'install' ]
2 info using [email protected]
3 info using [email protected]
4 verbose npm-session 044451a60ab46648
5 silly install runPreinstallTopLevelLifecycles
6 silly preinstall [email protected]
7 info lifecycle [email protected]~preinstall: [email protected]
8 silly install loadCurrentTree
9 silly install readLocalPackageData
10 timing stage:loadCurrentTree Completed in 4728ms
11 silly install loadIdealTree
12 silly install cloneCurrentTreeToIdealTree
13 timing stage:loadIdealTree:cloneCurrentTree Completed in 11ms
14 silly install loadShrinkwrap
15 timing stage:rollbackFailedOptional Completed in 1ms
16 timing stage:runTopLevelLifecycles Completed in 4941ms
17 silly saveTree [email protected]
18 verbose stack TypeError: Cannot read property 'match' of undefined
18 verbose stack     at tarballToVersion (/usr/lib/node_modules/npm/lib/install/inflate-shrinkwrap.js:87:20)
18 verbose stack     at inflatableChild (/usr/lib/node_modules/npm/lib/install/inflate-shrinkwrap.js:99:22)
18 verbose stack     at /usr/lib/node_modules/npm/lib/install/inflate-shrinkwrap.js:55:12
18 verbose stack     at tryCatcher (/usr/lib/node_modules/npm/node_modules/bluebird/js/release/util.js:16:23)
18 verbose stack     at Object.gotValue (/usr/lib/node_modules/npm/node_modules/bluebird/js/release/reduce.js:155:18)
18 verbose stack     at Object.gotAccum (/usr/lib/node_modules/npm/node_modules/bluebird/js/release/reduce.js:144:25)
18 verbose stack     at Object.tryCatcher (/usr/lib/node_modules/npm/node_modules/bluebird/js/release/util.js:16:23)
18 verbose stack     at Promise._settlePromiseFromHandler (/usr/lib/node_modules/npm/node_modules/bluebird/js/release/promise.js:517:31)
18 verbose stack     at Promise._settlePromise (/usr/lib/node_modules/npm/node_modules/bluebird/js/release/promise.js:574:18)
18 verbose stack     at Promise._settlePromise0 (/usr/lib/node_modules/npm/node_modules/bluebird/js/release/promise.js:619:10)
18 verbose stack     at Promise._settlePromises (/usr/lib/node_modules/npm/node_modules/bluebird/js/release/promise.js:699:18)
18 verbose stack     at _drainQueueStep (/usr/lib/node_modules/npm/node_modules/bluebird/js/release/async.js:138:12)
18 verbose stack     at _drainQueue (/usr/lib/node_modules/npm/node_modules/bluebird/js/release/async.js:131:9)
18 verbose stack     at Async._drainQueues (/usr/lib/node_modules/npm/node_modules/bluebird/js/release/async.js:147:5)
18 verbose stack     at Immediate.Async.drainQueues [as _onImmediate] (/usr/lib/node_modules/npm/node_modules/bluebird/js/release/async.js:17:14)
18 verbose stack     at processImmediate (internal/timers.js:456:21)
19 verbose cwd /root/test/node-cache
20 verbose Linux 4.19.76-linuxkit
21 verbose argv "/usr/bin/node" "/usr/bin/npm" "install"
22 verbose node v12.16.1
23 verbose npm  v6.13.4
24 error Cannot read property 'match' of undefined
25 verbose exit [ 1, true ]

When

The factors that seem to cause the invalid lock file to be generated are:

• Linux environment
• node_modules already exists
• package-lock.json does not exist

How

Steps to Reproduce

I can reproduce it in a node:12-alpine docker container with this minimalized package.json:

{
  "name": "test",
  "version": "1.0.0",
  "dependencies": {
    "fork-ts-checker-webpack-plugin": "~3.1.1",
    "stylemark": "~3.1.3",
    "webpack": "~4.41.2"
  }
}

and the following commands:

# The first time works because node_modules doesn't exist
# The generated package-lock.json is correct too
$ npm install

# Remove the package-lock.json to cause the issue
$ rm package-lock.json

# This install succeeds but generates a bad lock file
$ npm install

$ npm install
npm ERR! Cannot read property 'match' of undefined

The lock file contains this JSON object that I think is causing the issue:

"fsevents": {
  "dependencies": {
    "rc": {}
  }
}

Here are the error log, package.json, and both good (first) and bad package-lock.json files:

error.log
package.json
good-package-lock.json
bad-package-lock.json

[aquila8134]

I get the same error.

[transmissions11]

Happened to me today.

[darcyclarke]

npm v6 is no longer in active development; We will continue to push security releases to v6 at our team's discretion as-per our Support Policy.

If your bug is preproducible on v7, please re-file this issue using our new issue template.

If your issue was a feature request, please consider opening a new RRFC or RFC. If your issue was a question or other idea that was not CLI-specific, consider opening a discussion on our feedback repo

Closing: This is an automated message.