Issue 1:
Is there an existing issue for this?

I have searched the existing issues

Current Behavior

The npm audit --production command includes vulnerabilities of transitive devDependencies in its report. Using @thiagoelg/node-printer as an example, a vulnerability is reported for diff if @thiagoelg/node-printer is declared as a dependency. But diff is not installed by npm install --production, because it is a transitive dependency of nodeunit, which is a devDependency of @thiagoelg/node-printer.

Expected Behavior

found 0 vulnerabilities

Steps To Reproduce

npm init -y
npm install --save @thiagoelg/node-printer@^0.5.5
npm audit --production

Output

# npm audit report

diff <3.5.0
Severity: high
Regular Expression Denial of Service - https://npmjs.com/advisories/1631
fix available via `npm audit fix`
node_modules/@thiagoelg/node-printer/node_modules/diff
tap-mocha-reporter 0.0.4 - 5.0.0
Depends on vulnerable versions of diff
node_modules/@thiagoelg/node-printer/node_modules/tap-mocha-reporter
tap 7.0.0 - 14.6.7 || 14.10.2-totally-bundled - 14.10.2-unbundled
Depends on vulnerable versions of tap-mocha-reporter
node_modules/@thiagoelg/node-printer/node_modules/tap
nodeunit >=0.9.3
Depends on vulnerable versions of tap
node_modules/@thiagoelg/node-printer/node_modules/nodeunit

hosted-git-info <2.8.9 || >=3.0.0 <3.0.8
Severity: moderate
Regular Expression Denial of Service - https://npmjs.com/advisories/1677
fix available via `npm audit fix`
node_modules/@thiagoelg/node-printer/node_modules/hosted-git-info

lodash <=4.17.20
Severity: high
Prototype Pollution - https://npmjs.com/advisories/1523
Command Injection - https://npmjs.com/advisories/1673
fix available via `npm audit fix`
node_modules/@thiagoelg/node-printer/node_modules/lodash

y18n <3.2.2||=4.0.0||>=5.0.0 <5.0.5
Severity: high
Prototype Pollution - https://npmjs.com/advisories/1654
fix available via `npm audit fix`
node_modules/@thiagoelg/node-printer/node_modules/y18n

7 vulnerabilities (1 moderate, 6 high)

To address all issues, run:
npm audit fix

Environment

OS: Ubuntu 18.04

Node: 14.17.2

npm: 7.19.1

Issue 2:
Is there an existing issue for this?

I have searched the existing issues

This issue exists in the latest npm version

I am using the latest npm

Current Behavior

When installing a package (npm install <package name>) from the npm registry that contains an npm-shrinkwrap.json, dependencies listed with "dev": true are installed unexpectedly.

Expected Behavior

devDependencies of the published package should not be installed when consuming the package.

Steps To Reproduce

Given: Node.js v16.13.2 and npm v8.3.2

I created an example project to showcase this issue: https://github.com/RandomByte/npm-shrinkwrap-test

git clone git@github.com:RandomByte/npm-shrinkwrap-test.git && cd npm-shrinkwrap-test

npm install

Check for known devDependency "ava" and notice that it has been installed:

npm ls -a | grep 'ava'
> ├─┬ ava@3.15.0 extraneous

npm prune --production removes the ava package. But a following npm install will install it again

It seems that after installing @ui5/cli@next in the empty project, its devDependencies where installed as normal dependencies. This is unexpected since a consumer of the package does not need its devDependencies.

In the past (with npm v6) we worked around this issue by executing npm prune --production followed by npm shrinkwrap during publishing of the @ui5/cli package. This basically removed all devDependencies from the npm-shrinkwrap.json (see SAP/ui5-tooling#283 (comment)). But this does not seem to work with npm v8 anymore, as the npm-shrinkwrap.json is not being updated after the prune took place.

I think the fundamental issue is present since at least npm v6. Relevant issues are:

#1036

#1878

#1113

This issue has actually been fixed: In the project above npm install --production does not install the dependency's devDependencies. However, I would expect this exact behavior from npm install (without the --production flag) since I don't see a point in installing transitive devDependencies

Environment

npm: v8.3.2

Node.js: v16.13.2

OS Name: macOS 12.1 (Monterey)

System Model Name: MacBook Pro

npm config:

registry = "https://registry.npmjs.com/"