[BUG] <failure in the local development environment concerning non-deterministic dependency resolution and inadequate process reaping within the npm lifecycle.>

[lazyboii147-dot]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

When performing a standard dependency update process, specifically after running npm install or executing an automated dependency management script, I am experiencing intermittent "hangs" and non-deterministic process terminations. Despite the npm output suggesting successful completion, the node_modules directory remains in an inconsistent state. Subsequent build tasks, specifically within my Webpack-based pipeline, intermittently fail with Module not found errors or EADDRINUSE conflicts, even though the application logs do not indicate any previous instances of the server running. Furthermore, there is a recurring discrepancy where the package-lock.json hash changes unexpectedly, despite no explicit changes to the package.json manifest, suggesting that sub-dependencies are being dynamically resolved in ways that bypass the expected lockfile integrity constraints.

Expected Behavior

I expect npm install and associated build scripts to perform deterministic, reproducible installs that align strictly with the existing package-lock.json. The environment should maintain absolute integrity between the node_modules tree and the lockfile across different execution contexts. Furthermore, I anticipate that the npm process will handle signal exits gracefully, ensuring that all spawned subprocesses—especially those initiated by webpack-dev-server or lifecycle hooks—are properly reaped upon completion or interruption. My environment should remain clean, with no stale artifacts or port locks remaining after a service stop, ensuring that the development cycle remains stable, predictable, and free of ghost processes or configuration drift.

Steps To Reproduce

Steps To Reproduce
Initialize the workspace by removing the local node_modules folder and the package-lock.json file: rm -rf node_modules package-lock.json.

Execute the installation command with strict adherence to the lockfile: npm ci.

Observe the installation output and monitor process behavior; note if the process stalls during the "reify" phase or during the execution of post-install lifecycle scripts.

Once installation is complete, run the development server via the configured script: npm run start.

Attempt a clean shutdown using Ctrl+C or a SIGTERM signal.

Immediately attempt to restart the server: npm run start.

If the server fails to bind the port, verify the process tree for any lingering node or webpack instances that were not terminated by the parent npm process.

Perform a secondary npm install without making changes to package.json and compare the package-lock.json file against its previous state to detect unauthorized or silent dependency tree mutations.

Environment

npm -v: 10.8.2

node -v: v20.14.0

OS Name: Arch Linux (Kernel 6.9.7)

System Model Name: Custom Build / AMD Ryzen 9 7950X

npm config ls:

Ini, TOML
; "user" config from /home/enrique/.npmrc
cache = "/home/enrique/.npm/_cacache"
prefix = "/home/enrique/.npm-global"
registry = "https://registry.npmjs.org/"
strict-ssl = true
update-notifier = true
user-agent = "npm/10.8.2 node/v20.14.0 linux x64 workspaces/false"

[lazyboii147-dot]

Strategy | Action -- | -- Install Cooldowns | Implement a minimumReleaseAge (e.g., 7 days) to ensure new packages or versions are not malicious "zero-days". Disable Scripts | Set npm config set ignore-scripts true globally or use pnpm / Bun policies to block automatic execution of lifecycle scripts. Registry Proxying | Use a private registry proxy to restrict access to the public npm registry and prevent dependency confusion by enforcing scoped namespaces. Pipeline Hardening | Audit CI/CD workflows (especially pull_request_target) to prevent secret exposure. Rotate all credentials immediately if a build environment is suspected of compromise. Dependency Pinning | Use npm ci and commit lockfiles (package-lock.json) to ensure deterministic, verified installs. Behavioral Tools | Use tools like Socket or npq to monitor packages for suspicious behavior (e.g., unexpected network access) during installation.