[BUG] NPM >= 10.3.0 - bundling local dependency causes installation issues

[timges]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

When a project is packaged with a local dependency included in bundledDependencies:

• Installing the package results in repeated warnings about tarball corruption
• NPM fails to resolve the bundled dependency

Error Output

npm warn tarball tarball data for some-dependency@file:../somewhere-outside-of-this-project.tgz (null) seems to be corrupted. Trying again.
npm warn tarball tarball data for some-dependency@file:../somewhere-outside-of-this-project.tgz (null) seems to be corrupted. Trying again.
npm error code ENOENT
npm error syscall open
npm error path /path/to/project/node_modules/some-dependency
npm error errno -2
npm error ENOENT: no such file or directory, open '/path/to/project/node_modules/some-dependency'

Impact

Breaks packaging and distribution of projects with local dependencies that were previously working correctly.

Expected Behavior

• The package should be installable without errors
• The local dependency should be resolvable from the bundled node_modules

Steps To Reproduce

{
  "name": "example-project",
  "version": "1.0.0",
  "dependencies": {
    "some-dependency": "file:../somewhere-outside-of-this-project.tgz"
  },
  "bundledDependencies": [
    "some-dependency"
  ]
}

1. Create a project with a local dependency installed
2. Add the dependency to bundledDependencies
3. Run npm pack to create the package
4. Attempt to install the packed package in a different project

Environment

• npm: >=10.3.0
• Node.js: >=20.11.1
• OS Name: MacOS
• System Model Name: Macbook Pro 2021
• npm config:

; node bin location = /Users/[confidential]/.nvm/versions/node/v20.11.1/bin/node
; node version = v22.13.1
; npm local prefix = [confidential]
; npm version = 10.9.2
; cwd = [confidential]
; HOME = [confidential]
; Run `npm config ls -l` to show all defaults.```

[milaninfy]

@timges This is working as expected on latest npm@11.2.0 and not able to reproduce.

~/workarea/rep/test-override $ npm -v
11.2.0
~/workarea/rep/test-override $ node -v
v22.14.0

~/workarea/rep/test-alias $ npm install --save-bundle ../pkg/pkg-1.0.0.tgz 

added 1 package, and audited 2 packages in 532ms

1 moderate severity vulnerability

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.
~/workarea/rep/test-alias $ cat package.json 
{
  "name": "test-alias",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "type": "commonjs",
  "dependencies": {
    "pkg": "file:../pkg/pkg-1.0.0.tgz"
  },
  "bundleDependencies": [
    "pkg"
  ]
}
~/workarea/rep/test-alias $ npm ls
test-alias@1.0.0 /Users/milaninfy/workarea/rep/test-alias
└── pkg@1.0.0

~/workarea/rep/test-alias $ npm pack
npm notice
npm notice 📦  test-alias@1.0.0
npm notice Tarball Contents
npm notice 351B package.json
npm notice Bundled Dependencies
npm notice pkg
npm notice Tarball Details
npm notice name: test-alias
npm notice version: 1.0.0
npm notice filename: test-alias-1.0.0.tgz
npm notice package size: 352 B
npm notice unpacked size: 590 B
npm notice shasum: 30f7de39ae1f4d82f9a8fb4f24ca887ace516bf6
npm notice integrity: sha512-yOkYWgTKBY6d5[...]Ic2r5u1cmppEg==
npm notice bundled deps: 1
npm notice bundled files: 0
npm notice own files: 2
npm notice total files: 2
npm notice
test-alias-1.0.0.tgz

~/workarea/rep/test-override $ npm init -y
Wrote to /Users/milaninfy/workarea/rep/test-override/package.json:

{
  "name": "test-override",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "type": "commonjs"
}



~/workarea/rep/test-override $ npm install ../test-alias/test-alias-1.0.0.tgz 

added 1 package, and audited 3 packages in 2s

1 moderate severity vulnerability

To address all issues, run:
  npm audit fix

Run `npm audit` for details.
~/workarea/rep/test-override $ npm ls 
test-override@1.0.0 /Users/milaninfy/workarea/rep/test-override
└── test-alias@1.0.0

~/workarea/rep/test-override $ tree
.
├── node_modules
│   └── test-alias
│       ├── node_modules
│       │   └── pkg
│       │       └── package.json
│       └── package.json
├── package-lock.json
└── package.json