[BUG] `install-strategy=linked`: `.bin` shim left dangling after `npm uninstall`

[manzoorwanijk]

Part of #9608.

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

After npm uninstall <pkg> under install-strategy=linked, the package's bin shim in the root node_modules/.bin/ is left behind as a dangling symlink pointing at the removed package. The package's top-level symlink and its .store/ entry are correctly removed, but the .bin entry is not. The hoisted strategy removes the .bin entry correctly.

Expected Behavior

npm uninstall under the linked strategy should remove the bin shims of removed packages from the root node_modules/.bin/, leaving no dangling entries (matching the hoisted strategy).

Steps To Reproduce

cd "$(mktemp -d)"
echo 'install-strategy=linked' > .npmrc
cat > package.json <<'EOF'
{ "name": "un", "version": "1.0.0",
  "dependencies": { "rimraf": "3.0.2", "minimatch": "3.0.4" } }
EOF
npm install >/dev/null
ls node_modules/.bin                 # rimraf
npm uninstall rimraf >/dev/null
ls -l node_modules/.bin/rimraf
#   node_modules/.bin/rimraf -> ../rimraf/bin.js   (dangling; ../rimraf no longer exists)

# hoisted: node_modules/.bin is emptied correctly

Environment

• npm: 12.0.0-pre.1 (latest)
• Node.js: v24.17.0
• OS Name: macOS (Darwin 25.5.0)
• System Model Name: MacBook (arm64)
• npm config:

install-strategy=linked