[BUG] npm install --production creates/leaves behind empty directories of some devDependencies

[rmuchall]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

When using the command npm install --production npm creates (and/or fails to remove during execution) empty directories for some devDependencies.

Expected Behavior

When using the command npm --production I expect npm to install only the packages listed in dependencies, omit the packages listed in devDependencies and not create/leave behind empty directories for any devDependency packages.

Steps To Reproduce

1. Create a new directory with the following package.json:

{
  "name": "npm-test",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "dayjs": "^1.10.7"
  },
  "devDependencies": {
    "webpack-cli": "^4.9.1"
  }
}

2. Execute the following command: npm install --production
3. Note that npm has created (and/or not removed during execution) empty directories that correspond to some devDependencies. (See attached screenshot).

Environment

• OS: Windows 10
• Node: v16.13.0
• npm: 8.1.0

[russau]

I have exactly this problem! I notice it is also downloading the devDependencies. This makes the build slower and makes docker images bigger than they should be. I don't think this is the expected behaviour?

To reproduce, launch a node docker container.

docker run -it --rm  node:gallium-alpine3.14 sh

Inside the container create the @rmuchall sample package.json, then npm install it.

cat << EOF > package.json
{
  "name": "npm-test",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "dayjs": "^1.10.7"
  },
  "devDependencies": {
    "webpack-cli": "^4.9.1"
  }
}
EOF
npm install --production --loglevel verbose

In the output I see requests for webpack.

npm http fetch GET 200 https://registry.npmjs.org/webpack-cli 55ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/webpack 39ms (cache miss)

See the full log output: npm.log

[russau]

For comparison I tested with a package.json that has the devDependencies removed:

{
  "name": "npm-test",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "dayjs": "^1.10.7"
  }
}

The output looks like this: npm2.log

[simonmcallister0210]

Had the same issue on Debian (stretch). Tested a bunch of NPM versions (v8.19.2 - v7.0.0) and had the same issue. The latest version that doesn't have the issue is v6.14.17, so using that as a work around for now

[BenjaminStuermer]

I am encountering an issue that I believe is the same as this one.

I am using node v21.4.0 and NPM v10.2.5. Here is my package.json:

{
  "name": "bob-the-amazing",
  "dependencies": {
    "es-module-shims": "1.8.0"
  },
  "devDependencies": {
    "@babel/core": "^7.22.5"
  }
}

When I run NODE_ENV=production npm install, only es-module-shims ends up installed, but there are additional empty directories:

$ ls -lR
total 0
drwxr-xr-x  2 benjamin  staff   64 Dec 21 12:34 @ampproject
drwxr-xr-x  2 benjamin  staff   64 Dec 21 12:34 @babel
drwxr-xr-x  2 benjamin  staff   64 Dec 21 12:34 @jridgewell
drwxr-xr-x  7 benjamin  staff  224 Dec 21 12:34 es-module-shims

./@ampproject:
total 0

./@babel:
total 0

./@jridgewell:
total 0

./es-module-shims:
total 112
-rw-r--r--  1 benjamin  staff   1095 Dec 21 12:34 LICENSE
-rw-r--r--  1 benjamin  staff  40008 Dec 21 12:34 README.md
drwxr-xr-x  5 benjamin  staff    160 Dec 21 12:34 dist
-rw-r--r--  1 benjamin  staff   5739 Dec 21 12:34 index.d.ts
-rw-r--r--  1 benjamin  staff   1343 Dec 21 12:34 package.json

./es-module-shims/dist:
total 336
-rw-r--r--  1 benjamin  staff  58416 Dec 21 12:34 es-module-shims.debug.js
-rw-r--r--  1 benjamin  staff  57256 Dec 21 12:34 es-module-shims.js
-rw-r--r--  1 benjamin  staff  50446 Dec 21 12:34 es-module-shims.wasm.js

The fact that all the empty directories begin with "@" suggests to me that there might be an issue with that character. This is also the case when I install my actual package.json, which has a much larger number of devDependencies; it leaves behind a great many more empty directories, but all the directories left behind have names beginning with "@".