[BUG] `install-strategy=linked`: `npm install --audit` reports "0 vulnerabilities" when a vulnerable package is installed

[manzoorwanijk]

Part of #9608.

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

With install-strategy=linked, the audit run during npm install --audit reports found 0 vulnerabilities even when a known-vulnerable package is installed. The standalone npm audit command reports the vulnerability correctly, so only the install-time audit is affected. The hoisted strategy reports the vulnerability for the identical dependency set.

Expected Behavior

Under the linked strategy, the install-time audit should report the same vulnerabilities as the hoisted strategy (and as standalone npm audit) for the same dependency set.

Steps To Reproduce

cd "$(mktemp -d)"
echo 'install-strategy=linked' > .npmrc
cat > package.json <<'EOF'
{ "name": "ap", "version": "1.0.0", "dependencies": { "minimatch": "3.0.4" } }
EOF

npm install --audit
#   ... audited 5 packages ...
#   found 0 vulnerabilities          <-- incorrect

npm audit
#   1 high severity vulnerability    <-- standalone audit is correct

# hoisted reports it at install time:
rm -rf node_modules package-lock.json
npm install --install-strategy=hoisted --audit
#   1 high severity vulnerability

Environment

• npm: 12.0.0-pre.1 (latest)
• Node.js: v24.17.0
• OS Name: macOS (Darwin 25.5.0)
• System Model Name: MacBook (arm64)
• npm config:

install-strategy=linked