[BUG] Linked install strategy hoists all workspace packages to root `node_modules`

[manzoorwanijk]

Is there an existing issue for this?

• I have searched the existing issues
• I am using the latest npm

Current Behavior

With install-strategy=linked, all workspace packages are unconditionally symlinked into the root node_modules/, regardless of whether the root or any other workspace declares them as a dependency. This makes every workspace resolvable from anywhere in the monorepo, defeating the strict isolation that the linked strategy is supposed to provide.

Related: #6537 (same problem with --install-strategy=nested — workspace symlinks are hoisted to root instead of being placed in dependent packages' node_modules). This issue reports the same behavior with --install-strategy=linked.

Expected Behavior

Workspace packages should only appear in the node_modules/ of packages that declare them as dependencies. If @scope/a depends on @scope/b, the symlink should be at:

packages/a/node_modules/@scope/b -> packages/b

Not at:

node_modules/@scope/b -> packages/b

Steps To Reproduce

1. Create a workspace monorepo:

   mkdir repro && cd repro
   mkdir -p packages/a packages/b

2. With this config:

   package.json:

   {
     "name": "repro",
     "workspaces": ["packages/*"]
   }

   packages/a/package.json:

   {
     "name": "@scope/a",
     "version": "1.0.0",
     "dependencies": {
       "@scope/b": "*"
     }
   }

   packages/b/package.json:

   {
     "name": "@scope/b",
     "version": "1.0.0"
   }

   .npmrc:

   install-strategy=linked

3. Run npm install

4. See that both @scope/a and @scope/b are symlinked at root:

   node_modules/@scope/a -> ../../packages/a
   node_modules/@scope/b -> ../../packages/b
   

   Neither package should appear at root since the root package.json does not depend on them.

Environment

• npm: v10.9.5 and v11 (latest) -- both affected
• Node.js: v22.20.0
• OS Name: macOS (Darwin)
• npm config:

  install-strategy=linked

[manzoorwanijk]

@wraithgar, I am planning to pick this up after your "fake Node and Link" cleanup PR - #9069

[wraithgar]

Yay! I hope it's marginally easier to tackle after the refactor.

[manzoorwanijk]

The fix is ready for review - #9076