[BUG] `npm ls` reports dist-tag dependencies as invalid under `install-strategy=linked`

[manzoorwanijk]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

With install-strategy=linked, any dependency declared with a dist-tag spec (e.g. "latest") is reported invalid by npm ls, which exits 1 with ELSPROBLEMS. This applies to root dependencies and to transitive ones inside .store (seen with @paulirish/trace_engine, which depends on legacy-javascript: "latest"). Hoisted is clean, and npm install itself reports "up to date".

Expected Behavior

npm ls exits 0 and shows abbrev@5.0.0 without invalid, as it does under install-strategy=hoisted.

Steps To Reproduce

mkdir x && cd x
printf '{"name":"r","version":"1.0.0","dependencies":{"abbrev":"latest"}}' > package.json
printf 'install-strategy=linked\n' > .npmrc
npm install --no-audit --no-fund   # exit 0
npm ls                             # expected: abbrev@5.0.0, exit 0; actual: abbrev@5.0.0 invalid: "latest" from the root project, ELSPROBLEMS, exit 1
rm node_modules/.package-lock.json
npm ls                             # same failure on the filesystem scan path

Environment

• npm: 12.0.2 and latest source (c9876d7)
• Node.js: v24.18.0
• OS Name: macOS Darwin 25.6.0
• npm config: install-strategy=linked