Switching to yarn "fixed" it
Discussion
Yarn is better anyways. The yarn.lock file is actually a proper lock file.
Agreed, I switched back to npm after about 10 years to try it out, and... yeah
The fact npm modifies the package-lock.json file when you run npm install is frustrating. Just install the same set of packages every time.