<h3 dir="auto">Is there an existing issue for this?</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have searched the existing issues</li>
</ul>
<h3 dir="auto">This issue exists in the latest npm version</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I am using the latest npm</li>
</ul>
<h3 dir="auto">Current Behavior</h3>
<p dir="auto">When I run <code class="notranslate">npm ci</code> and a <code class="notranslate">yarn.lock</code> file is present and is read-only, it fails due to requesting write permission it does not need:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="npm ERR! code EPERM
npm ERR! syscall open
npm ERR! path C:\git\mytestproject\yarn.lock
npm ERR! errno -4048
npm ERR! Error: EPERM: operation not permitted, open 'C:\git\mytestproject\yarn.lock'
npm ERR!  [Error: EPERM: operation not permitted, open 'C:\git\mytestproject\yarn.lock'] {
npm ERR!   errno: -4048,
npm ERR!   code: 'EPERM',
npm ERR!   syscall: 'open',
npm ERR!   path: 'C:\\git\\mytestproject\\yarn.lock'
npm ERR! }
npm ERR!
npm ERR! The operation was rejected by your operating system.
npm ERR! It's possible that the file was already in use (by a text editor or antivirus),
npm ERR! or that you lack permissions to access it.
npm ERR!
npm ERR! If you believe this might be a permissions issue, please double-check the
npm ERR! permissions of the file and its containing directories, or try running
npm ERR! the command again as root/Administrator.

npm ERR! A complete log of this run can be found in:
npm ERR!     C:\Users\myusername\AppData\Local\npm-cache\_logs\2022-08-17T18_25_43_640Z-debug-0.log"><pre class="notranslate"><code class="notranslate">npm ERR! code EPERM
npm ERR! syscall open
npm ERR! path C:\git\mytestproject\yarn.lock
npm ERR! errno -4048
npm ERR! Error: EPERM: operation not permitted, open 'C:\git\mytestproject\yarn.lock'
npm ERR!  [Error: EPERM: operation not permitted, open 'C:\git\mytestproject\yarn.lock'] {
npm ERR!   errno: -4048,
npm ERR!   code: 'EPERM',
npm ERR!   syscall: 'open',
npm ERR!   path: 'C:\\git\\mytestproject\\yarn.lock'
npm ERR! }
npm ERR!
npm ERR! The operation was rejected by your operating system.
npm ERR! It's possible that the file was already in use (by a text editor or antivirus),
npm ERR! or that you lack permissions to access it.
npm ERR!
npm ERR! If you believe this might be a permissions issue, please double-check the
npm ERR! permissions of the file and its containing directories, or try running
npm ERR! the command again as root/Administrator.

npm ERR! A complete log of this run can be found in:
npm ERR!     C:\Users\myusername\AppData\Local\npm-cache\_logs\2022-08-17T18_25_43_640Z-debug-0.log
</code></pre></div>
<h3 dir="auto">Expected Behavior</h3>
<p dir="auto">Running <code class="notranslate">npm ci</code> should not request write access when opening <code class="notranslate">yarn.lock</code>, since it is only reading the file.</p>
<h3 dir="auto">Steps To Reproduce</h3>
<ol dir="auto">
<li>In an environment with a recent NPM (found on 8.1.2 and 8.4.1, then updated to latest 8.17.0 to confirm)</li>
<li>With a <code class="notranslate">yarn.lock</code> file present and marked as read-only</li>
<li>Run <code class="notranslate">npm ci</code></li>
<li>Observe error <code class="notranslate">npm ERR! Error: EPERM: operation not permitted, open '&lt;path&gt;\yarn.lock'</code></li>
</ol>
<h3 dir="auto">Environment</h3>
<ul dir="auto">
<li>npm: 8.17.0</li>
<li>Node.js: v16.14.0</li>
<li>OS Name: Windows 10 version 21H2</li>
<li>System Model Name: Dell</li>
<li>npm config:</li>
</ul>
<div class="highlight highlight-source-ini notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="; &quot;builtin&quot; config from C:\Users\myusername\AppData\Roaming\npm\node_modules\npm\npmrc

prefix = &quot;C:\\Users\\myusername\\AppData\\Roaming\\npm&quot;

; &quot;user&quot; config from C:\Users\myusername\.npmrc

@isi-itp:registry = &quot;https://npm.pkg.github.com/&quot;
//npm.pkg.github.com/:_authToken = (protected)
enableStrictSsl = false
msvs_version = &quot;2019&quot;
strict-ssl = false

; node bin location = C:\Program Files\nodejs\node.exe
; cwd = C:\git\mytestproject
; HOME = C:\Users\myusername
; Run `npm config ls -l` to show all defaults."><pre class="notranslate"><span class="pl-c"><span class="pl-c">;</span> "builtin" config from C:\Users\myusername\AppData\Roaming\npm\node_modules\npm\npmrc</span>

<span class="pl-k">prefix</span> = <span class="pl-s"><span class="pl-pds">"</span>C:\\Users\\myusername\\AppData\\Roaming\\npm<span class="pl-pds">"</span></span>

<span class="pl-c"><span class="pl-c">;</span> "user" config from C:\Users\myusername\.npmrc</span>

@isi-itp:<span class="pl-k">registry</span> = <span class="pl-s"><span class="pl-pds">"</span>https://npm.pkg.github.com/<span class="pl-pds">"</span></span>
//npm.pkg.github.com/:<span class="pl-k">_authToken</span> = (protected)
<span class="pl-k">enableStrictSsl</span> = false
<span class="pl-k">msvs_version</span> = <span class="pl-s"><span class="pl-pds">"</span>2019<span class="pl-pds">"</span></span>
<span class="pl-k">strict-ssl</span> = false

<span class="pl-c"><span class="pl-c">;</span> node bin location = C:\Program Files\nodejs\node.exe</span>
<span class="pl-c"><span class="pl-c">;</span> cwd = C:\git\mytestproject</span>
<span class="pl-c"><span class="pl-c">;</span> HOME = C:\Users\myusername</span>
<span class="pl-c"><span class="pl-c">;</span> Run `npm config ls -l` to show all defaults.</span></pre></div>
<h3 dir="auto">Is there an existing issue for this?</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have searched the existing issues</li>
</ul>
<h3 dir="auto">This issue exists in the latest npm version</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I am using the latest npm</li>
</ul>
<h3 dir="auto">Current Behavior</h3>
<p dir="auto">If you run <code class="notranslate">npm install</code> in a project that has a <code class="notranslate">yarn.lock</code> file, npm changes both the syntax, data and order of <code class="notranslate">yarn.lock</code> file.</p>
<p dir="auto">Changes I've spotted that shouldn't happen:</p>
<ul dir="auto">
<li>npm adds double-quotes around everything (<code class="notranslate">is-number@^7.0.0:</code> becomes <code class="notranslate">"is-number@^7.0.0":</code>, <code class="notranslate">version</code> becomes <code class="notranslate">"version"</code> and so on)</li>
<li>Registry URLs get overwritten (<code class="notranslate">"https://registry.yarnpkg.com/is-number/-/is-number-7.0.0.tgz#7535345b896734d5f80c4d06c50955527a14f12b"</code> becomes <code class="notranslate">"https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz"</code>)</li>
<li>Order of keys becomes shuffled (<code class="notranslate">yarn.lock</code> has <code class="notranslate">version</code>, <code class="notranslate">resolved</code>, <code class="notranslate">integrity</code> in that order, after <code class="notranslate">npm install</code>, the order becomes <code class="notranslate">integrity</code>, <code class="notranslate">resolved</code>, <code class="notranslate">version</code>)</li>
</ul>
<h3 dir="auto">Expected Behavior</h3>
<p dir="auto">No commands run with <code class="notranslate">npm</code> should modify files <code class="notranslate">npm</code> doesn't have anything to do with, namely <code class="notranslate">yarn.lock</code> which is managed by a different program than <code class="notranslate">npm</code>.</p>
<h3 dir="auto">Steps To Reproduce</h3>
<ol dir="auto">
<li><code class="notranslate">cd $(mktemp -d)</code> Create new temporary directory for a test project</li>
<li><code class="notranslate">npm init --yes</code> Create new package.json</li>
<li><code class="notranslate">npm install --save is-number</code> Add a dependency</li>
<li><code class="notranslate">yarn install</code> Install dependencies via yarn, creating the <code class="notranslate">yarn.lock</code> file</li>
<li><code class="notranslate">cp yarn.lock yarn.lock.original</code> Save a copy of the original <code class="notranslate">yarn.lock</code> file</li>
<li><code class="notranslate">npm install</code> Run npm install again which modifies the <code class="notranslate">yarn.lock</code> file unexpectedly</li>
<li><code class="notranslate">diff yarn.lock yarn.lock.original</code> show the difference between the npm-modified yarn.lock file with the original one that yarn itself produces</li>
</ol>
<h3 dir="auto">Environment</h3>
<ul dir="auto">
<li>npm: <code class="notranslate">8.13.2</code></li>
<li>Node.js: <code class="notranslate">v18.4.0</code></li>
<li>OS Name: <code class="notranslate">Arch Linux</code></li>
<li>System Model Name: <code class="notranslate">Desktop</code></li>
<li>npm config:</li>
</ul>
<div class="highlight highlight-source-ini notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="; &quot;user&quot; config from /home/user/.npmrc

//registry.npmjs.org/:_authToken = (protected)

; node bin location = /home/user/.nvm/versions/node/v18.4.0/bin/node
; node version = v18.4.0
; npm local prefix = /tmp/tmp.YKcr2lMqCS
; npm version = 8.13.2
; cwd = /tmp/tmp.YKcr2lMqCS
; HOME = /home/user
; Run `npm config ls -l` to show all defaults."><pre class="notranslate"><span class="pl-c"><span class="pl-c">;</span> "user" config from /home/user/.npmrc</span>

//registry.npmjs.org/:<span class="pl-k">_authToken</span> = (protected)

<span class="pl-c"><span class="pl-c">;</span> node bin location = /home/user/.nvm/versions/node/v18.4.0/bin/node</span>
<span class="pl-c"><span class="pl-c">;</span> node version = v18.4.0</span>
<span class="pl-c"><span class="pl-c">;</span> npm local prefix = /tmp/tmp.YKcr2lMqCS</span>
<span class="pl-c"><span class="pl-c">;</span> npm version = 8.13.2</span>
<span class="pl-c"><span class="pl-c">;</span> cwd = /tmp/tmp.YKcr2lMqCS</span>
<span class="pl-c"><span class="pl-c">;</span> HOME = /home/user</span>
<span class="pl-c"><span class="pl-c">;</span> Run `npm config ls -l` to show all defaults.</span></pre></div>