NPM removes required dependency when installing new dependency

Question

I'm having a weird and constant problem on my machine. Every time I install some new npm dependency, gulp magically disappears from the node_modules folder.

gulp is currently installed as devDependency as: "gulp": "github:gulpjs/gulp"

if I issue the usual npm install everything goes back to normal

Just to be extremely clear:

$ npm install github:gulpjs/gulp --save-dev
npm WARN ajv-keywords@3.2.0 requires a peer of ajv@^6.0.0 but none is installed. You must install peer dependencies yourself.

+ gulp@4.0.0
added 183 packages in 26.452s

and then if I try to install something new...

$ npm install eyeglass --verbose
npm info it worked if it ends with ok
npm verb cli [ '/Users/peach/.nvm/versions/node/v8.11.3/bin/node',
npm verb cli   '/Users/peach/.nvm/versions/node/v8.11.3/bin/npm',
npm verb cli   'install',
npm verb cli   'eyeglass',
npm verb cli   '--verbose' ]
npm info using npm@5.6.0
npm info using node@v8.11.3
npm verb npm-session 48e35d62250ec820
npm http fetch GET 200 https://registry.npmjs.org/eyeglass 15ms (from cache)
npm http fetch GET 200 https://registry.npmjs.org/ensure-symlink 20ms (from cache)
npm http fetch GET 200 https://registry.npmjs.org/archy 22ms (from cache)
npm http fetch GET 200 https://registry.npmjs.org/deasync 21ms (from cache)
npm http fetch GET 200 https://registry.npmjs.org/lodash.includes 20ms (from cache)
npm http fetch GET 200 https://registry.npmjs.org/fs-extra 21ms (from cache)
npm http fetch GET 200 https://registry.npmjs.org/lodash.merge 24ms (from cache)
npm http fetch GET 200 https://registry.npmjs.org/node-sass-utils 25ms (from cache)
npm http fetch GET 200 https://registry.npmjs.org/bindings 3ms (from cache)
npm verb correctMkdir /Users/peach/.npm/_locks correctMkdir not in flight; initializing
npm verb lock using /Users/peach/.npm/_locks/staging-89e2cc30db562072.lock for /Users/peach/repos/sotb-six/node_modules/.staging
npm info lifecycle gulp@4.0.0~preuninstall: gulp@4.0.0
npm info lifecycle gulp@4.0.0~uninstall: gulp@4.0.0
npm verb unbuild rmStuff gulp@4.0.0 from /Users/peach/repos/sotb-six/node_modules
npm info lifecycle gulp@4.0.0~postuninstall: gulp@4.0.0
...

+ eyeglass@1.5.0
removed 183 packages and updated 1 package in 10.707s
npm verb exit [ 0, true ]
npm info ok

Which is then followed but a lot of other package removal...

No idea what's going on and I'm out of luck trying to find a solution for this for this

using npm@5.6.0 and node@v8.11.3

[edit] Tried removing package-lock.json and go through the re-installation of gulp and then separately of $whateverpackage, but same result happens.

$ rm package-lock.json
$ npm install github:gulpjs/gulp
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN ajv-keywords@3.2.0 requires a peer of ajv@^6.0.0 but none is installed. You must install peer dependencies yourself.

+ gulp@4.0.0
added 183 packages in 32.953s
$ ls -l node_modules/.bin/gulp
lrwxr-xr-x 1 peach staff 19 Jul  9 13:24 node_modules/.bin/gulp -> ../gulp/bin/gulp.js
$ npm install eyeglass
npm WARN ajv-keywords@3.2.0 requires a peer of ajv@^6.0.0 but none is installed. You must install peer dependencies yourself.

+ eyeglass@1.5.0
removed 183 packages and updated 1 package in 12.959s
$ ls -l node_modules/.bin/gulp
ls: cannot access 'node_modules/.bin/gulp': No such file or directory

Answer 1

this is due to a bug in npm: https://github.com/npm/npm/issues/19394

Upgrading to npm >= 5.7.0 will solve the issue.