Searching for "app" in your package.json files, did any of them use a mixture of link: and non-link dependency that accidentally got checked in?

A typical packages/backend/package.json can have a line that looks like this:

"dependencies": {
  (...)
  "app": "link:../app",

but maybe there's more in there or in other nearby files that collides with that.

This is the package.json inside package/backend

{
"name": "backend",
"version": "0.0.0",
"main": "dist/index.cjs.js",
"types": "src/index.ts",
"private": true,
"backstage": {
"role": "backend"
},
"scripts": {
"start": "backstage-cli package start",
"build": "backstage-cli package build",
"lint": "backstage-cli package lint",
"test": "backstage-cli package test",
"clean": "backstage-cli package clean",
"build-image": "docker build ../.. -f Dockerfile --tag backstage"
},
"dependencies": {
"@backstage/backend-common": "^0.25.0",
"@backstage/backend-defaults": "^0.5.3",
"@backstage/backend-tasks": "^0.6.1",
"@backstage/config": "^1.3.0",
"@backstage/plugin-app-backend": "^0.4.2",
"@backstage/plugin-auth-backend": "^0.24.0",
"@backstage/plugin-auth-backend-module-atlassian-provider": "^0.3.2",
"@backstage/plugin-auth-backend-module-github-provider": "^0.2.2",
"@backstage/plugin-auth-backend-module-guest-provider": "^0.2.2",
"@backstage/plugin-auth-node": "^0.5.4",
"@backstage/plugin-catalog-backend": "^1.28.0",
"@backstage/plugin-catalog-backend-module-github-org": "^0.3.4",
"@backstage/plugin-catalog-backend-module-gitlab": "^0.5.0",
"@backstage/plugin-catalog-backend-module-gitlab-org": "^0.2.3",
"@backstage/plugin-catalog-backend-module-scaffolder-entity-model": "^0.2.2",
"@backstage/plugin-permission-backend": "^0.5.51",
"@backstage/plugin-permission-backend-module-allow-all-policy": "^0.2.2",
"@backstage/plugin-permission-common": "^0.8.2",
"@backstage/plugin-permission-node": "^0.8.5",
"@backstage/plugin-proxy-backend": "^0.5.8",
"@backstage/plugin-scaffolder-backend": "^1.27.2",
"@backstage/plugin-search-backend": "^1.7.0",
"@backstage/plugin-search-backend-module-catalog": "^0.2.5",
"@backstage/plugin-search-backend-module-techdocs": "^0.3.3",
"@backstage/plugin-search-backend-node": "^1.3.5",
"@backstage/plugin-techdocs-backend": "^1.11.3",
"app": "link:../app",
"better-sqlite3": "^9.0.0",
"node-gyp": "^10.0.0",
"pg": "^8.11.3",
"winston": "^3.2.1"
},
"devDependencies": {
"@backstage/cli": "^0.29.2",
"@types/express": "^4.17.6",
"@types/express-serve-static-core": "^4.17.5",
"@types/luxon": "^2.0.4"
},
"files": [
"dist"
]
}

Hm, npm-app-0.0.0 should probably not be in the yarn cache. You seem to have ended up in a weird state where yarn tries to actually install the app as if it were from external npm, rather than your local repository (from where it should never be published to npm of course). Maybe you have something that has ended up wrong in your workspace setup. Maybe migrating to yarn 4 which is better about these things, can help too.

Are there any reproduction steps to be had, where this behaviour happens (starting with a create-app call preferably) so that we can see whether it's an actual open source fixable thing?