Is there an existing issue for this?

• [x] I have searched the existing issues

This issue exists in the latest npm version

• [x] I am using the latest npm

This is not just a request to bump a dependency for a CVE

• [x] This is not solely a request to bump a dependency for a CVE

Current Behavior

When using install-strategy=linked and adding a package to allowScripts I get weird output:

{
    "allowScripts": {
        "file:../../../[email protected]/node_modules/vue-demi": true,
        "file:../../../[email protected]/node_modules/esbuild": true,
        "file:../../[email protected]/node_modules/esbuild": true
    }
}

Expected Behavior

When not using a linked install strategy I get concise entries, without duplicates (see the difference for esbuild)

{
    "allowScripts": {
        "[email protected]": true,
        "[email protected]": true
    }
}

Steps To Reproduce

1. Create a clean project
2. Add install-strategy = "linked" to the .npmrc
3. Install esbuild
4. Run npm install-scripts approve esbuild
5. Look at the state of allowScripts in package.json

Environment

• npm: 11.19.0
• Node.js: 26.7.0
• OS Name: macOS Sequoia 15.7.9
• System Model Name: Macbook Pro
• npm config: ```ini ; "user" config

; min-release-age = 14 ; overridden by project

; "project" config

install-strategy = "linked" min-release-age = 14

; node bin location = /Users/name/.nvm/versions/node/v26.7.0/bin/node ; node version = v26.7.0 ; npm local prefix = /Volumes/projects/project ; npm version = 11.19.0 ; cwd = /Volumes/projects/project ; HOME = /Users/name ; Run npm config ls -l to show all defaults. ```