[BUG] install-strategy=linked: a workspace inside another workspace's folder gets no dependencies installed #10082

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

Take a root whose workspaces lists a folder and a workspace inside that folder, ["packages/outer", "packages/outer/src/*"]. With install-strategy=linked, npm installs nothing for the inner workspace. packages/outer/src/inner/node_modules is never created, so the inner workspace cannot resolve its own dependencies, and npm install reports up to date without fetching them. npm ls --all reports the workspace as UNMET DEPENDENCY / missing: inner@file:…, required by root@1.0.0 and exits 1, and npm ls --workspaces leaves it out.

npm ci from a lockfile generated with --install-strategy=hoisted (which records the inner workspace's dependencies) gives the same result. With install-strategy=hoisted, everything works.

Related, but not the same:

• [BUG] install-strategy=linked: workspace-only / undeclared workspaces are invisible to npm ls and npm query #9618 and [BUG] linked strategy: npm ls reports undeclared workspaces as UNMET DEPENDENCY #9090 (both closed) are about workspaces that sit side by side, not one inside another.
• [BUG] Installing dependencies of nested workspaces seems to not work properly in version 8.5+ #4774 is about a workspace that declares workspaces of its own, installed from inside it. Here the root declares both paths.

Expected Behavior

The inner workspace's dependencies are installed and resolvable from it, and npm ls lists the workspace like any other, matching install-strategy=hoisted.

Steps To Reproduce

cd "$(mktemp -d)"
mkdir -p packages/outer/src/inner
echo '{"name":"root","version":"1.0.0","workspaces":["packages/outer","packages/outer/src/*"]}' > package.json
echo '{"name":"outer","version":"1.0.0"}' > packages/outer/package.json
echo '{"name":"inner","version":"1.0.0","dependencies":{"is-number":"7.0.0"}}' > packages/outer/src/inner/package.json
echo 'install-strategy=linked' > .npmrc
npm install --no-audit --no-fund
# up to date in 128ms

ls packages/outer/src/inner/node_modules
# ls: cannot access 'packages/outer/src/inner/node_modules': No such file or directory

(cd packages/outer/src/inner && node -e "require.resolve('is-number')")
# Error: Cannot find module 'is-number'

npm ls --all
# root@1.0.0 <dir>
# ├── UNMET DEPENDENCY inner@file:<dir>/packages/outer/src/inner
# └── outer@1.0.0 -> ./packages/outer
# npm error code ELSPROBLEMS
# npm error missing: inner@file:<dir>/packages/outer/src/inner, required by root@1.0.0

With install-strategy=hoisted in .npmrc instead, is-number resolves from the inner workspace, and npm ls --all prints inner@1.0.0 -> ./packages/outer/src/inner and exits 0.

Environment

• npm: 12.2.0 (also reproduced on 11.19.0)
• Node.js: v24.21.0
• OS Name: Ubuntu 26.04.1 LTS
• System Model Name: not hardware-specific
• npm config:

; "project" config from <dir>/.npmrc

install-strategy = "linked"

Drafted by Claude (Anthropic AI assistant).