[BUG] `npm ls --all` does not list dependency tree without node_modules

[cx-david-moreira]

Current Behavior:

The command npm ls --all does not list the dependency tree, without node_modules folder. This command is failing to list the dependency tree with only the package-lock.json file, using npm v7.

Expected Behavior:

Using npm v6, the npm ls command is working as expected, by listing the dependency tree, with only the package.json and package-lock.json files present, and without node_modules folder.

Steps To Reproduce:

1. In a project folder with package.json and with package-lock.json files, and without node_modules folder
2. Run npm ls --all --json

or

1. In a project folder with package.json
2. Run npm install
3. Delete de node_modules folder
4. Run npm ls --all --json

Environment:

• OS: Windows 10
• Node: 14.15.1
• npm: 7.9.0

or

• OS: Debian 10
• Node: 12.13.0
• npm: 7.9.0

[nlf]

confirmed, easy to reproduce this one. thanks for letting us know!

[isaacs]

Umm.... I'm pretty sure npm@6 used the actual tree as well?

The output is almost identical between v6 and v7. There is a problem that we print two JSON blobs when there's errors in v7, though, that's a bug.

[G-Rath]

Pulling my comment over from my PR, since this is the better place to discuss:

@isaacs I've got need to have npm list behaviour on the virtual tree for audit-app to backfill information on dependency paths & versions because the new auditing output doesn't have all the information we need for that - using the virtual tree means you don't have to actually be able to successfully install saving a lot of time and pain when using tooling to do mass project auditing.

Additionally, there is the sort-of bug/inconsistency with the output of npm audit vs npm list that I mentioned in my PR (I tried to make a simple reproduction, but it proved too hard to pin down to just a few dependencies since npm would keep trying to pull in patched versions of ini) that this would help explain.

Would implementing a new flag (i.e --virtual) be on the table? I'd expect from what I was when exploring this issue originally, it shouldn't be too hard to implement (just a matter of having the flag and then changing the line from my PR to be if: loadVirtual; else: loadActual.

[milaninfy]

For some reason this was not closed but it looks like it's fixed by #3408.
npm-ls#package-lock-only