[BUG] Inconsistent `npm install` with workspaces

[Saibamen]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I need to do npm install twice to have the correct package-lock.json

Expected Behavior

package-lock.json is good on first npm install

Steps To Reproduce

1. Download repro repo: https://github.com/Saibamen/npm-bug-repro-workspaces
2. npm run clean:all (delete all node_modules folders + lock files)
3. npm install
4. npm audit --omit=dev
5. ❌ See vulnerabilities from lodash package
6. npm run clean (delete node_modules and lock file, but only in root folder)
7. npm install
8. npm audit --omit=dev
9. ❎ No vulnerabilities and changed lock file

Environment

• OS: Windows 11

; node bin location = C:\nvm4w\nodejs\node.exe
; node version = v24.14.0
; npm local prefix = C:\DEV\test_npm
; npm version = 11.12.0
; cwd = C:\DEV\test_npm
; HOME = C:\Users\AdamStachowicz

[Saibamen]

Here you can see diff between first and second npm install: Saibamen/npm-bug-repro-workspaces@d9b902f

[Saibamen]

npm ls lodash --omit=dev output after first npm install command in fresh repo (run npm run clean:all before):

+-- postman-collection@4.4.1 extraneous
| `-- lodash@4.17.21
`-- simplebar@6.3.3
  `-- simplebar-core@1.3.2
    `-- lodash@4.17.21 deduped

npm ls lodash --omit=dev output after second npm install command (run npm run clean before):

`-- simplebar@6.3.3
  `-- simplebar-core@1.3.2
    `-- lodash@4.17.23

[Saibamen]

npm ls lodash outputs (without omit dev)

npm ls lodash output after first npm install command in fresh repo (run npm run clean:all before):

+-- newman@1.0.0 -> .\workspace_1
| +-- newman@6.2.2
| | +-- lodash@4.17.21 deduped
| | +-- postman-collection-transformer@4.1.8
| | | `-- lodash@4.17.21 deduped
| | `-- postman-runtime@7.39.1
| |   +-- lodash@4.17.21 deduped
| |   +-- postman-collection@4.4.0
| |   | `-- lodash@4.17.21 deduped
| |   `-- postman-sandbox@4.7.1
| |     +-- lodash@4.17.21 deduped
| |     `-- postman-collection@4.4.0
| |       `-- lodash@4.17.21 deduped
| `-- postman-collection@4.4.0
|   `-- lodash@4.17.21 deduped
+-- postman-collection@4.4.1 extraneous
| `-- lodash@4.17.21
`-- simplebar@6.3.3
  `-- simplebar-core@1.3.2
    `-- lodash@4.17.21 deduped

npm ls lodash output after second npm install command (run npm run clean before):

+-- newman@1.0.0 -> .\workspace_1
| +-- newman@6.2.2
| | +-- lodash@4.17.21
| | +-- postman-collection-transformer@4.1.8
| | | `-- lodash@4.17.21
| | `-- postman-runtime@7.39.1
| |   +-- lodash@4.17.21
| |   `-- postman-sandbox@4.7.1
| |     `-- lodash@4.17.21
| `-- postman-collection@4.4.0
|   `-- lodash@4.17.21
`-- simplebar@6.3.3
  `-- simplebar-core@1.3.2
    `-- lodash@4.17.23