Duplicate modules in package-lock.json when using npm? - node.js

Question

I have noticed on node 15 and npm 7, when I switch from node 14 - duplicate entries for the same package. One is apollo-server-core which is fine. And the other is node_modules/apollo-server-core which was added when I run npm install with npm 7. Also notice that for every dependency I have, another entry with prefix node_modules/ was created. Was this purposefully added with npm 7 or is it a bug?
For example:
created with when used npm 7
"node_modules/apollo-server-core": {
"version": "2.19.0",
"resolved": "https://registry.npmjs.org/apollo-server-core/-/apollo-server-core-2.19.0.tgz",
"integrity": "sha512-2aMKUVPyNbomJQaG2tkpfqvp1Tfgxgkdr7nX5zHudYNSzsPrHw+CcYlCbIVFFI/mTZsjoK9czNq1qerFRxZbJw==",
"dependencies": {
"#apollographql/apollo-tools": "^0.4.3",
"#apollographql/graphql-playground-html": "1.6.26",
"#types/graphql-upload": "^8.0.0",
"#types/ws": "^7.0.0",
"apollo-cache-control": "^0.11.4",
"apollo-datasource": "^0.7.2",
"apollo-graphql": "^0.6.0",
"apollo-reporting-protobuf": "^0.6.1",
"apollo-server-caching": "^0.5.2",
"apollo-server-env": "^2.4.5",
"apollo-server-errors": "^2.4.2",
"apollo-server-plugin-base": "^0.10.2",
"apollo-server-types": "^0.6.1",
"apollo-tracing": "^0.12.0",
"async-retry": "^1.2.1",
"fast-json-stable-stringify": "^2.0.0",
"graphql-extensions": "^0.12.6",
"graphql-tag": "^2.9.2",
"graphql-tools": "^4.0.0",
"graphql-upload": "^8.0.2",
"loglevel": "^1.6.7",
"lru-cache": "^5.0.0",
"sha.js": "^2.4.11",
"subscriptions-transport-ws": "^0.9.11",
"uuid": "^8.0.0",
"ws": "^6.0.0"
},
"engines": {
"node": ">=6"
}
},
and
the usual entry
"apollo-server-core": {
"version": "2.19.0",
"resolved": "https://registry.npmjs.org/apollo-server-core/-/apollo-server-core-2.19.0.tgz",
"integrity": "sha512-2aMKUVPyNbomJQaG2tkpfqvp1Tfgxgkdr7nX5zHudYNSzsPrHw+CcYlCbIVFFI/mTZsjoK9czNq1qerFRxZbJw==",
"requires": {
"#apollographql/apollo-tools": "^0.4.3",
"#apollographql/graphql-playground-html": "1.6.26",
"#types/graphql-upload": "^8.0.0",
"#types/ws": "^7.0.0",
"apollo-cache-control": "^0.11.4",
"apollo-datasource": "^0.7.2",
"apollo-graphql": "^0.6.0",
"apollo-reporting-protobuf": "^0.6.1",
"apollo-server-caching": "^0.5.2",
"apollo-server-env": "^2.4.5",
"apollo-server-errors": "^2.4.2",
"apollo-server-plugin-base": "^0.10.2",
"apollo-server-types": "^0.6.1",
"apollo-tracing": "^0.12.0",
"async-retry": "^1.2.1",
"fast-json-stable-stringify": "^2.0.0",
"graphql-extensions": "^0.12.6",
"graphql-tag": "^2.9.2",
"graphql-tools": "^4.0.0",
"graphql-upload": "^8.0.2",
"loglevel": "^1.6.7",
"lru-cache": "^5.0.0",
"sha.js": "^2.4.11",
"subscriptions-transport-ws": "^0.9.11",
"uuid": "^8.0.0",
"ws": "^6.0.0"
},
"dependencies": {
"apollo-datasource": {
"version": "0.7.2",
"resolved": "https://registry.npmjs.org/apollo-datasource/-/apollo-datasource-0.7.2.tgz",
"integrity": "sha512-ibnW+s4BMp4K2AgzLEtvzkjg7dJgCaw9M5b5N0YKNmeRZRnl/I/qBTQae648FsRKgMwTbRQIvBhQ0URUFAqFOw==",
"requires": {
"apollo-server-caching": "^0.5.2",
"apollo-server-env": "^2.4.5"
}
},
"apollo-server-caching": {
"version": "0.5.2",
"resolved": "https://registry.npmjs.org/apollo-server-caching/-/apollo-server-caching-0.5.2.tgz",
"integrity": "sha512-HUcP3TlgRsuGgeTOn8QMbkdx0hLPXyEJehZIPrcof0ATz7j7aTPA4at7gaiFHCo8gk07DaWYGB3PFgjboXRcWQ==",
"requires": {
"lru-cache": "^5.0.0"
}
},
"fs-capacitor": {
"version": "6.2.0",
"resolved": "https://registry.npmjs.org/fs-capacitor/-/fs-capacitor-6.2.0.tgz",
"integrity": "sha512-nKcE1UduoSKX27NSZlg879LdQc94OtbOsEmKMN2MBNudXREvijRKx2GEBsTMTfws+BrbkJoEuynbGSVRSpauvw=="
},
"graphql-upload": {
"version": "https://registry.npmjs.org/graphql-upload/-/graphql-upload-11.0.0.tgz",
"integrity": "sha512-zsrDtu5gCbQFDWsNa5bMB4nf1LpKX9KDgh+f8oL1288ijV4RxeckhVozAjqjXAfRpxOHD1xOESsh6zq8SjdgjA==",
"requires": {
"busboy": "^0.3.1",
"fs-capacitor": "^6.1.0",
"http-errors": "^1.7.3",
"isobject": "^4.0.0",
"object-path": "^0.11.4"
}
},
"http-errors": {
"version": "1.8.0",
"resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.0.tgz",
"integrity": "sha512-4I8r0C5JDhT5VkvI47QktDW75rNlGVsUf/8hzjCC/wkWI/jdTRmBb9aI7erSG82r1bjKY3F6k28WnsVxB1C73A==",
"requires": {
"depd": "~1.1.2",
"inherits": "2.0.4",
"setprototypeof": "1.2.0",
"statuses": ">= 1.5.0 < 2",
"toidentifier": "1.0.0"
}
},
"setprototypeof": {
"version": "1.2.0",
"resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
"integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
},
"uuid": {
"version": "8.3.2",
"resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
"integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg=="
},
"ws": {
"version": "6.2.1",
"resolved": "https://registry.npmjs.org/ws/-/ws-6.2.1.tgz",
"integrity": "sha512-GIyAXC2cB7LjvpgMt9EKS2ldqr0MTrORaleiOno6TweZ6r3TKtoFQWay/2PceJ3RuBasOHzXNn5Lrw1X0bEjqA==",
"requires": {
"async-limiter": "~1.0.0"
}
}
}
}

Answer 1

npm 7 brought changes to the lockfile format to improve build consistency across machines.
The new entries your seeing (prefixed with "node_modules/") are in a new key "packages" that did not exist in earlier versions of npm. They are duplicated in the old key "dependencies" which is kept around for backward compatibility to old npm clients.

Answer 2

What #triskweline said.
I resolved the issue by deleting package-lock.json and then running the command npm i --package-lock-only. This will determine versions of packages to install using package.json, and then create a package-lock.json file with its resolved versions if none exists.
P.S. It doesn't install any package.