[BUG] arborist fetches packuments for optional peer deps that are never installed #9876

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

with an empty cache, npm install vite into an empty project installs 10 packages but fetches full packuments for playwright (16.6MB), @types/node (11MB), webdriverio, jsdom, sass, less, terser, and (via vite's optional peer on vitest) all of vitest's optional peers too...

Expected Behavior

nothing should be fetched at all unless something else in the tree actually installs the package. (pnpm and yarn don't fetch these, if that's relevant.)

Steps To Reproduce

1. mkdir repro && cd repro && npm init -y
2. npm install vite --cache ./.cache
3. grep -rl playwright .cache/_cacache/index-v5
4. the cache contains a 16.6MB playwright packument (and many others) for packages that were never installed

Environment

• npm: 11.15.0
• Node.js: v24.15.0
• OS Name: MacOS
• System Model Name: MacBook Pro
• npm config:

ignore-scripts = true
min-release-age = 2
omit-lockfile-registry-resolved = true