[BUG] `install --no-save` does not install anything

[kmhleonwillens]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Attempting to call install --no-save <package> will have no result in npm@^11. This issue does not exist in npm@^10.

Expected Behavior

Calling install --no-save <package> should download the package and place it in the node_modules folder but leave both package.json and package-lock.json unchanged.

Steps To Reproduce

1. Make sure you use npm@^11
2. In a NPM project, install any package by calling npm i --no-save <package>
3. There should be not associated directory in the node_modules folder.
4. NPM should return up to date instead of added X packages.

Environment

This problem occured on my local machine as well as on our pipeline using node:24 Docker container.

• npm: 11.10.1
• Node.js: 24.13.0
• OS Name: macOS Tahoe 26.2
• System Model Name: Macbook Pro 14" Nov. 2024 (Apple Silicon M4 Pro)
• npm config:

; "default" config from default values

_auth = (protected)
access = null
all = false
allow-git = "all"
allow-same-version = false
also = null
audit = true
audit-level = null
auth-type = "web"
before = null
bin-links = true
browser = null
bypass-2fa = false
ca = null
cache = "$HOME/.npm"
cache-max = null
cache-min = 0
cafile = null
call = ""
cert = null
cidr = null
color = true
commit-hooks = true
cpu = null
depth = null
description = true
dev = false
diff = []
diff-dst-prefix = "b/"
diff-ignore-all-space = false
diff-name-only = false
diff-no-prefix = false
diff-src-prefix = "a/"
diff-text = false
diff-unified = 3
dry-run = false
editor = "vi"
engine-strict = false
expect-result-count = null
expect-results = null
expires = null
fetch-retries = 2
fetch-retry-factor = 10
fetch-retry-maxtimeout = 60000
fetch-retry-mintimeout = 10000
fetch-timeout = 300000
force = false
foreground-scripts = false
format-package-lock = true
fund = true
git = "git"
git-tag-version = true
global = false
global-style = false
globalconfig = "$HOME/.nvm/versions/node/v24.13.0/etc/npmrc"
heading = "npm"
https-proxy = null
if-present = false
ignore-scripts = false
include = []
include-staged = false
include-workspace-root = false
init-author-email = ""
init-author-name = ""
init-author-url = ""
init-license = "ISC"
init-module = "$HOME/.npm-init.js"
init-private = false
init-type = "commonjs"
init-version = "1.0.0"
init.author.email = ""
init.author.name = ""
init.author.url = ""
init.license = "ISC"
init.module = "$HOME/.npm-init.js"
init.version = "1.0.0"
install-links = false
install-strategy = "hoisted"
json = false
key = null
legacy-bundling = false
legacy-peer-deps = false
libc = null
link = false
local-address = null
location = "user"
lockfile-version = null
loglevel = "notice"
logs-dir = null
logs-max = 10
; long = false ; overridden by cli
maxsockets = 15
message = "%s"
min-release-age = null
name = null
node-gyp = "$HOME/.nvm/versions/node/v24.13.0/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js"
node-options = null
noproxy = [""]
npm-version = "11.10.1"
offline = false
omit = []
omit-lockfile-registry-resolved = false
only = null
optional = null
orgs = null
orgs-permission = null
os = null
otp = null
pack-destination = "."
package = []
package-lock = true
package-lock-only = false
packages = []
packages-all = false
packages-and-scopes-permission = null
parseable = false
password = (protected)
prefer-dedupe = false
prefer-offline = false
prefer-online = false
prefix = "$HOME/.nvm/versions/node/v24.13.0"
preid = ""
production = null
progress = true
provenance = false
provenance-file = null
proxy = null
read-only = false
rebuild-bundle = true
registry = "https://registry.npmjs.org/"
replace-registry-host = "npmjs"
save = true
save-bundle = false
save-dev = false
save-exact = false
save-optional = false
save-peer = false
save-prefix = "^"
save-prod = false
sbom-format = null
sbom-type = "library"
scope = ""
scopes = null
script-shell = null
searchexclude = ""
searchlimit = 20
searchopts = ""
searchstaleness = 900
shell = "/bin/zsh"
shrinkwrap = true
sign-git-commit = false
sign-git-tag = false
strict-peer-deps = false
strict-ssl = true
tag = "latest"
tag-version-prefix = "v"
timing = false
token-description = null
umask = 0
unicode = true
update-notifier = true
usage = false
user-agent = "npm/{npm-version} node/{node-version} {platform} {arch} workspaces/{workspaces} {ci}"
userconfig = "$HOME/.npmrc"
version = false
versions = false
viewer = "man"
which = null
workspace = []
workspaces = null
workspaces-update = true
yes = null

; "user" config from $HOME/.npmrc

<private-registry> = "<anonymized>"
<private-registry>/:_authToken = (protected)

; "cli" config from command line options

long = true

[MRagunandhan24]

@kmhleonwillens , I unable to replicate the issue with npm 11.10.1. The requested package is added to node_modules folder without any change in package.json. If the package is not present initially in node_modules it responds with "added 1 package", and if the requested package is already present and up to date, npm responds with "up to date".

Can you please retry in the latest version and provide more information on a specific package that you are trying to install so that I can have a look.

[kmhleonwillens]

I will provide additional data on the project and some shell outputs.

package.json:

{
  "name": "my-project",
  "version": "1.0.0",
  "description": "",
  "author": "",
  "license": "UNLICENSED",
  "engines": {
    "node": "^20.19.0 <21.0.0 || ^22.13.0 <23.0.0 || ^24.0.0 <25.0.0"
  },
  "type": "module",
  "keywords": [],
  "scripts": {},
  "dependencies": {
    "@eslint/js": "^10.0.1",
    "@stylistic/eslint-plugin": "^5.9.0",
    "confusing-browser-globals": "^1.0.11",
    "eslint": "^10.0.2",
    "eslint-plugin-import": "^2.32.0",
    "globals": "^17.3.0",
    "typescript-eslint": "^8.56.1"
  },
  "devDependencies": {
    "@vue/tsconfig": "^0.8.1",
    "typescript": "^5.9.3"
  },
  "peerDependencies": {
    "@vitest/eslint-plugin": "^1.6.9",
    "@vue/eslint-config-typescript": "^14.7.0",
    "eslint-plugin-jest": "^29.15.0",
    "eslint-plugin-vue": "^10.8.0"
  },
  "overrides": {
    "eslint-plugin-import": {
      "eslint": "^10.0.2",
      "minimatch": "^10.2.2"
    }
  },
  "peerDependenciesMeta": {
    "@vitest/eslint-plugin": {
      "optional": true
    },
    "@vue/eslint-config-typescript": {
      "optional": true
    },
    "eslint-plugin-jest": {
      "optional": true
    },
    "eslint-plugin-vue": {
      "optional": true
    }
  }
}

Attempting to install --no-save eslint-plugin-jest.

The name ist referenced twice in the package-lock.json in the packages object that mimics the package.json.
I have deleted my node_modules folder and ensured to work with the current NPM version:

$ rm -rf ./node_modules 
$ nvm use
Found '$HOME/my-project/.nvmrc' with version <24>
Now using node v24.13.0 (npm v11.10.1)
$ npm i
added 209 packages, and audited 210 packages in 1s

113 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

Using ls -la ./node_modules I can confirm that the plugin ist not yet installed:

drwxr-xr-x@  10 user  group     320 Feb 25 09:22 eslint
drwxr-xr-x@   7 user  group     224 Feb 25 09:22 eslint-import-resolver-node
drwxr-xr-x@  37 user  group    1184 Feb 25 09:22 eslint-module-utils
drwxr-xr-x@  13 user  group     416 Feb 25 09:22 eslint-plugin-import
drwxr-xr-x@   7 user  group     224 Feb 25 09:22 eslint-scope
drwxr-xr-x@   7 user  group     224 Feb 25 09:22 eslint-visitor-keys

Now executing the plugin installation:

$ npm i --no-save eslint-plugin-jest

up to date, audited 210 packages in 4s

113 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

Executing ls -la ./node_modules a second time confirms that the plugin has not been installed:

drwxr-xr-x@  10 user  group     320 Feb 25 09:22 eslint
drwxr-xr-x@   7 user  group     224 Feb 25 09:22 eslint-import-resolver-node
drwxr-xr-x@  37 user  group    1184 Feb 25 09:22 eslint-module-utils
drwxr-xr-x@  13 user  group     416 Feb 25 09:22 eslint-plugin-import
drwxr-xr-x@   7 user  group     224 Feb 25 09:22 eslint-scope
drwxr-xr-x@   7 user  group     224 Feb 25 09:22 eslint-visitor-keys

Additional information

Apparently the problem cannot be replicated with a fresh project, so my only assumption is that the constellation of my dependencies somehow tampers with the flag behaviour; although, I don't see why.

Here's another machine where we have replicated the behaviour:
NPM version: 11.6.2
OS: Windows 11 Business 26100.7781
Model: Lenovo ThinkPad T14s

If you need more information, I'll happily provide.