Issue 1:
Is there an existing issue for this?

I have searched the existing issues

This issue exists in the latest npm version

I am using the latest npm

Current Behavior

When I run npm ci and a yarn.lock file is present and is read-only, it fails due to requesting write permission it does not need:

npm ERR! code EPERM
npm ERR! syscall open
npm ERR! path C:\git\mytestproject\yarn.lock
npm ERR! errno -4048
npm ERR! Error: EPERM: operation not permitted, open 'C:\git\mytestproject\yarn.lock'
npm ERR! [Error: EPERM: operation not permitted, open 'C:\git\mytestproject\yarn.lock'] {
npm ERR! errno: -4048,
npm ERR! code: 'EPERM',
npm ERR! syscall: 'open',
npm ERR! path: 'C:\\git\\mytestproject\\yarn.lock'
npm ERR! }
npm ERR!
npm ERR! The operation was rejected by your operating system.
npm ERR! It's possible that the file was already in use (by a text editor or antivirus),
npm ERR! or that you lack permissions to access it.
npm ERR!
npm ERR! If you believe this might be a permissions issue, please double-check the
npm ERR! permissions of the file and its containing directories, or try running
npm ERR! the command again as root/Administrator.

npm ERR! A complete log of this run can be found in:
npm ERR! C:\Users\myusername\AppData\Local\npm-cache\_logs\2022-08-17T18_25_43_640Z-debug-0.log

Expected Behavior

Running npm ci should not request write access when opening yarn.lock, since it is only reading the file.

Steps To Reproduce

In an environment with a recent NPM (found on 8.1.2 and 8.4.1, then updated to latest 8.17.0 to confirm)

With a yarn.lock file present and marked as read-only

Run npm ci

Observe error npm ERR! Error: EPERM: operation not permitted, open '<path>\yarn.lock'

Environment

npm: 8.17.0

Node.js: v16.14.0

OS Name: Windows 10 version 21H2

System Model Name: Dell

npm config:

; "builtin" config from C:\Users\myusername\AppData\Roaming\npm\node_modules\npm\npmrc

prefix = "C:\\Users\\myusername\\AppData\\Roaming\\npm"

; "user" config from C:\Users\myusername\.npmrc

@isi-itp:registry = "https://npm.pkg.github.com/"
//npm.pkg.github.com/:_authToken = (protected)
enableStrictSsl = false
msvs_version = "2019"
strict-ssl = false

; node bin location = C:\Program Files\nodejs\node.exe
; cwd = C:\git\mytestproject
; HOME = C:\Users\myusername
; Run `npm config ls -l` to show all defaults.

Issue 2:
Is there an existing issue for this?

I have searched the existing issues

This issue exists in the latest npm version

I am using the latest npm

Current Behavior

If you run npm install in a project that has a yarn.lock file, npm changes both the syntax, data and order of yarn.lock file.

Changes I've spotted that shouldn't happen:

npm adds double-quotes around everything (is-number@^7.0.0: becomes "is-number@^7.0.0":, version becomes "version" and so on)

Registry URLs get overwritten ("https://registry.yarnpkg.com/is-number/-/is-number-7.0.0.tgz#7535345b896734d5f80c4d06c50955527a14f12b" becomes "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz")

Order of keys becomes shuffled (yarn.lock has version, resolved, integrity in that order, after npm install, the order becomes integrity, resolved, version)

Expected Behavior

No commands run with npm should modify files npm doesn't have anything to do with, namely yarn.lock which is managed by a different program than npm.

Steps To Reproduce

cd $(mktemp -d) Create new temporary directory for a test project

npm init --yes Create new package.json

npm install --save is-number Add a dependency

yarn install Install dependencies via yarn, creating the yarn.lock file

cp yarn.lock yarn.lock.original Save a copy of the original yarn.lock file

npm install Run npm install again which modifies the yarn.lock file unexpectedly

diff yarn.lock yarn.lock.original show the difference between the npm-modified yarn.lock file with the original one that yarn itself produces

Environment

npm: 8.13.2

Node.js: v18.4.0

OS Name: Arch Linux

System Model Name: Desktop

npm config:

; "user" config from /home/user/.npmrc

//registry.npmjs.org/:_authToken = (protected)

; node bin location = /home/user/.nvm/versions/node/v18.4.0/bin/node
; node version = v18.4.0
; npm local prefix = /tmp/tmp.YKcr2lMqCS
; npm version = 8.13.2
; cwd = /tmp/tmp.YKcr2lMqCS
; HOME = /home/user
; Run `npm config ls -l` to show all defaults.