[BUG] `npm-shrinkwrap.json` published within package is ignored during `npm i somepackage`

[wiggisser]

Is there an existing issue for this?

• I have searched the existing issues

I've seen a similar issues in #5349 and #5325 but they seem to be about installing local tarballs only, and one of them even mentions, that it works if installing from remote. But that't not the case for me. May also be related to #4583 as I'm not using npmjs.org as registry but github.

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I have a package @myorg/shrinkwraptest (which is published and installable via github). The published package includes a npm-shrinkwrap.json file which looks like this

{
  "name": "@myorg/shrinkwraptest",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@myorg/shrinkwraptest",
      "version": "1.0.0",
      "license": "ISC",
      "dependencies": {
        "mogoose": "^8.1"
      },
...
    "node_modules/mongodb": {
      "version": "6.3.0",
      "resolved": "https://registry.npmjs.org/mongodb/-/mongodb-6.3.0.tgz",
      "integrity": "sha512-tt0KuGjGtLUhLoU263+xvQmPHEGTw5LbcNC73EoFRYgSHwZt5tsoJC110hDyO1kjQzpgNrpdcSza9PknWN4LrA==",
      "dependencies": {
        "@mongodb-js/saslprep": "^1.1.0",
        "bson": "^6.2.0",
        "mongodb-connection-string-url": "^3.0.0"
      },
      "engines": {
        "node": ">=16.20.1"
      },
    },
    ...
    "node_modules/mongoose": {
      "version": "8.1.3",
      "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-8.1.3.tgz",
      "integrity": "sha512-a5MajZSDJiQgy0iQcR+MIpFe7zehGJI4doJ6Dh1MvnGh8/HNNhr5pn07RPA86KCTjP2vuKdffpFmvXxcHiUOjw==",
      "dependencies": {
        "bson": "^6.2.0",
        "kareem": "2.5.1",
        "mongodb": "6.3.0",
        "mpath": "0.9.0",
        "mquery": "5.0.0",
        "ms": "2.1.3",
        "sift": "16.0.1"
      },
      "engines": {
        "node": ">=16.20.1"
      },
      "funding": {
        "type": "opencollective",
        "url": "https://opencollective.com/mongoose"
      }
    }
    ...
  }
}

When I then do npm i @myorg/shrinkwraptest.json in a new empty folder and then inspect the node_modules folder I see, that the mongoose package is installed in version 8.8.4 and the mongodb package is installed in version 6.10.0 (which are the respective latest versions at the time I'm creating this issue)

This is the (relevant) output of npm ls --depth 3

/test # npm ls --depth 3
test@ /test
`-- @myorg/shrinkwrap@1.0.0
  `-- mongoose@8.8.4
    ...
    +-- mongodb@6.10.0
   ...

Expected Behavior

Reading the docs, I'd expect when I do an

npm i @myorg/shrinkwraptest

this contained npm-shrinkwrap.json should be respected and mongoose@8.1.3 and mongodb@6.3 should be installed.

Steps To Reproduce

1. Install a package from a remote repository which has a npm-shrinkwrap.json bundled with it
2. Compare the versions the contained npm-shrinkwrap.json with the version of the acutally installed packages

Environment

Environment

• npm: 10.9.2
• Node.js: 23.4.0
• OS Name: FROM node:23.4-alpine3.20
• npm config:

; "user" config from /root/.npmrc

@myorg:registry = "https://npm.pkg.github.com/"
//npm.pkg.github.com/:_authToken = ...

; node bin location = /usr/local/bin/node
; node version = v23.4.0
; npm local prefix = /test
; npm version = 10.9.2
; cwd = /test
; HOME = /root

[moll]

This is still the case as of today with Node v22's NPM v10.9.3 — NPM fails to honor npm-shrinkwrap.json when doing npm install foo.tgz. I've yet to try NPM v11.5.2.

[wiggisser]

Any progress on this?

[sfry]

This seems extremely dangerous. I believe some organizations were hit because of this with the recent Axios compromise, thinking they were safe with a shrinkwrap file.

[gmsewell6]

This seems extremely dangerous. I believe some organizations were hit because of this with the recent Axios compromise, thinking they were safe with a shrinkwrap file.

Bumping. Absolute agree. What ever did become of this? The issue tags got mucked with over a year ago. Hope something is coming of it.

I hadn't had any reason myself to question whether this worked or not before. But now in the wake of the Axios situation, here I am stumbling on this issue thread that seems to have been unfortunately buried.

[owlstronaut]

#9262