`npm:` alias / override packages lose alias identity and break graph

[KazariEX]

Describe the bug

node-modules-inspector appears to use the resolved package name from package metadata as the package identity. For npm: aliases and pnpm overrides, that name can differ from the declared dependency name.

Example: nuxt: "npm:nuxt-nightly@..." should appear as nuxt, while still using nuxt-nightly for npm metadata. When the alias identity is lost, dependency graph edges can be attached to the wrong package or dropped, and “open local folder” can resolve to the virtual-store real package path instead of the alias folder under node_modules.

Minimal reproduction

Direct alias case:

{
  "name": "nmi-alias-repro",
  "private": true,
  "dependencies": {
    "color-a": "npm:supports-color@8.1.1",
    "color-b": "npm:supports-color@8.1.1"
  }
}

Override alias case:

{
  "name": "nmi-override-repro",
  "private": true,
  "dependencies": {
    "chalk": "4.1.2",
    "supports-color": "4.3.4"
  },
  "pnpm": {
    "overrides": {
      "supports-color": "npm:debug@4.3.4"
    }
  }
}

Run:

pnpm install
pnpm dlx node-modules-inspector --depth 25

Expected

• The graph keeps declared names as package identity: color-a, color-b, supports-color, nuxt.
• npm metadata/external links use the real package name when different: supports-color, debug, nuxt-nightly.
• “Open local folder” opens the alias symlink, for example node_modules/nuxt or node_modules/supports-color.

Actual

• Alias packages may be shown/keyed as the real package name from package.json.
• Dependency edges can be missing or merged when multiple aliases resolve to the same real package.
• Some packages can appear with no dependencies after pnpm returns a deduped alias entry first.
• Local folder resolution can point at .pnpm/<real-package>.../node_modules/<real-package> instead of node_modules/<alias>.

Notes

In pnpm data, the dependency map key is the declared alias, while the package object/installed package.json uses the real package name. These need to be tracked separately:

• graph identity: declared alias name
• npm identity: real package name
• local path: alias path from the parent node_modules/<alias> relationship

---

This issue was created with assistance from a code agent.