When module is listed in both "devDependencies" and "dependencies", result is uncertain.

[markstos]

We had a module which was accidentally listed as both a regular "dependency" and "devDependency".

We found that deploys involving "npm-shrinkwrap sync" would intermittently fail.

It appears that may have been a race condition between trying to delete the module and install the module which caused the failure.

I realize that modules shouldn't be listed as both kinds of dependencies, but it would be nice if this could be coped with.

[markstos]

I think I have mis-characterized the nature of the conflict I found. What I'm seeing is that bcrypt looks in it's build directory for some essential file at run time, but npm-shrinkwrap sync has removed the build directory.

[Raynos]

Hmm; strange. the npm-shrinkwrap sync command is not something we are stressing in production; We use it for local convenience but use npm install for production builds.