Part of #9608.

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

Under install-strategy=linked, a direct registry dependency is reported by npm query with its node_modules/.store/<key>/node_modules/<pkg> backing path as its location, instead of the logical node_modules/<pkg> edge location. The hoisted strategy reports the logical location. This breaks tooling that consumes npm query locations.

Expected Behavior

npm query should report the logical dependency location (node_modules/<pkg>) for direct dependencies under the linked strategy, matching the hoisted strategy.

Steps To Reproduce

cd "$(mktemp -d)"
echo 'install-strategy=linked' > .npmrc
echo '{ "name": "q", "version": "1.0.0", "dependencies": { "abbrev": "2.0.0" } }' > package.json
npm install >/dev/null
npm query ':root > *'
#   linked:  "location": "node_modules/.store/abbrev@2.0.0-<hash>/node_modules/abbrev"
#   hoisted: "location": "node_modules/abbrev"

Environment

• npm: 12.0.0-pre.1 (latest)
• Node.js: v24.17.0
• OS Name: macOS (Darwin 25.5.0)
• System Model Name: MacBook (arm64)
• npm config:

install-strategy=linked