EISGIT error with some github dependencies in 6.9.0

What I Wanted to Do

npm install with success

What Happened Instead

npm ERR! path /home/travis/build/fs-webdev/my-private-repo/node_modules/strong
npm ERR! code EISGIT
npm ERR! git /home/travis/build/fs-webdev/my-private-repo/node_modules/strong: Appears to be a git repo or submodule.
npm ERR! git     /home/travis/build/fs-webdev/my-private-repo/node_modules/strong
npm ERR! git Refusing to remove it. Update manually,
npm ERR! git or move it out of the way first.

Reproduction Steps

We have a private github repo that has a github dependency on another private github repo which has a dependency on a public github repo:

fs-webdev/my-private-repo depends on “github:fs-webdev/another-private-repo” which depends on “github:fs-webdev/strong” which is a public repo.

{
  "name": "npm-bug",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "another-private-repo": "github:fs-webdev/another-private-repo"
  }
}

another-private-repo has a dependency like this (with many others):

 "strong": "github:fs-webdev/strong",

If I create a new repo with npm init and do:
npm i fs-webdev/strong
it works fine, but if I do
npm i fs-webdev/another-private-repo
then I get the error about EISGIT and strong

Details

We have package-locks disabled due to another dependency

Similar error to `npm pack` includes items from `.git` folder if there is a branch called `readme` (regression in 6.9.0)
but this repo does not have a branch named readme

We have been loading this dependency this way for years, and it just started breaking with npm 6.9.0. Reverting to npm 6.8.0 or 6.4.1 (node 10.1.5.3) seems to resolve the problem.

We have dozens of projects with this problem which we all have to pin back to npm 6.8 or node 10.15 to get around this.

if you remove the offending package and run npm i again, it works in 6.9.0 as well:

$ npm i
npm ERR! path /private/tmp/npm-bug/node_modules/strong
npm ERR! code EISGIT
npm ERR! git /private/tmp/npm-bug/node_modules/strong: Appears to be a git repo or submodule.
npm ERR! git     /private/tmp/npm-bug/node_modules/strong
npm ERR! git Refusing to remove it. Update manually,
npm ERR! git or move it out of the way first.

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/me/.npm/_logs/2019-06-04T15_49_06_311Z-debug.log
$ rm -r node_modules/strong/
$ npm i
npm WARN npm-bug@1.0.0 No description
npm WARN npm-bug@1.0.0 No repository field.

added 5 packages from 5 contributors, removed 2 packages and audited 1289 packages in 6.236s
found 14 vulnerabilities (9 low, 4 moderate, 1 high)
  run `npm audit fix` to fix them, or `npm audit` for details

when trying to reproduce this locally occasionally it would seem to work. So I’m not sure what the trigger is, but it always fails in our automated builds in Travis and other systems.

Platform Info

node 10.16.0
npm 6.9.0

$ npm --versions
```$ npm --versions
{ 'npm-bug': '1.0.0',
  npm: '6.9.0',
  ares: '1.15.0',
  brotli: '1.0.7',
  cldr: '35.1',
  http_parser: '2.8.0',
  icu: '64.2',
  modules: '64',
  napi: '4',
  nghttp2: '1.34.0',
  node: '10.16.0',
  openssl: '1.1.1b',
  tz: '2019a',
  unicode: '12.1',
  uv: '1.28.0',
  v8: '6.8.275.32-node.52',
  zlib: '1.2.11' }

$ node -p process.platform

darwin

though it happens on multiple platforms

After watching several of our builds, sometimes it is working and sometimes not. I haven’t found a pattern yet.

We’ve replicated this consistently, but only in travisCI. Our workaround for now is to just pin Node in our Travis builds to v10.15, which in turn pins npm to v.6.4.1 in the interest of keeping our tests run as quickly as possible, as opposed to re-installing an older npm version ahead of installing node v10.16.