[BUG] `install-strategy=linked`: `npm sbom` fails with ESBOMPROBLEMS (transitive devDependencies reported missing)

[manzoorwanijk]

Part of #9608.

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

With install-strategy=linked, npm sbom exits non-zero with ESBOMPROBLEMS, listing the devDependencies of transitive packages (e.g. matcha, tape — devDependencies of balanced-match / brace-expansion) as missing: ... required by .... Those dev dependencies are correctly not installed (the same is true under hoisted), yet only the linked strategy treats them as missing-and-required. Under hoisted, npm sbom produces a clean SBOM for the same dependency set.

Expected Behavior

npm sbom under the linked strategy should produce an SBOM without errors, matching the hoisted strategy, and should not treat transitive packages' devDependencies as required/missing.

Steps To Reproduce

cd "$(mktemp -d)"
echo 'install-strategy=linked' > .npmrc
cat > package.json <<'EOF'
{ "name": "sp", "version": "1.0.0", "dependencies": { "minimatch": "3.0.4" } }
EOF
npm install >/dev/null
npm sbom --sbom-format=cyclonedx
#   npm error code ESBOMPROBLEMS
#   npm error missing: matcha@^0.7.0, required by balanced-match@1.0.2
#   npm error missing: tape@^4.6.0, required by balanced-match@1.0.2
#   ... (0 components)

# hoisted produces a clean SBOM (6 components):
rm -rf node_modules package-lock.json
npm install --install-strategy=hoisted >/dev/null
npm sbom --sbom-format=cyclonedx

Environment

• npm: 12.0.0-pre.1 (latest)
• Node.js: v24.17.0
• OS Name: macOS (Darwin 25.5.0)
• System Model Name: MacBook (arm64)
• npm config:

install-strategy=linked