This is a "dependency tree realization" bug.

The problem here is that invoking npm rm module may cause the node_modules tree to be in an invalid state because npm rm is not dedupe aware.

Reproduction case:

mkdir ~/tmp/foobar
cd ~/tmp/foobar
npm init
npm i [email protected] -S
npm i [email protected] -S
npm ls
echo "npm ls is good $?"
npm rm routes -S
npm ls
echo "npm ls should be good but is bad $?"

The expected output is that the second npm ls exits zero instead of one.

Suggested fix:

Break the logic that is lib/update.js that finds all copies of module in a node_modules tree out into a function.

Then use that function to find all copies in lib/uninstall.js and then just invoke npm.commands.install for each one.