Oh wow, thank you for sharing that. I would not have guessed that a lock file isn’t locked. Does installing with
npm i package-name -E resolve the issue?
It looks like something similar happens with Yarn, although I didn’t read all one million of the comments in that issue — maybe it was resolved.
This might be an interesting one to investigate…