audit: Ensure we don't mutate the shrinkwrap

PR-URL: #20389 Credit: @iarna Reviewed-By: @zkat

Author: iarna

lib/install/audit.js

@@ -22,6 +22,7 @@ const url = require('url')
 const npa = require('npm-package-arg')
 const uuid = require('uuid')
 const ssri = require('ssri')
+const cloneDeep = require('lodash.clonedeep')
 
 // used when scrubbing module names/specifiers
 const runId = uuid.v4()
@@ -100,7 +101,7 @@ function printFullReport (auditResult) {
 }
 
 function generate (shrinkwrap, requires, diffs, install, remove) {
- const sw = Object.assign({}, shrinkwrap)
+ const sw = cloneDeep(shrinkwrap)
  delete sw.lockfileVersion
  sw.requires = scrubRequires(requires)
  scrubDeps(sw.dependencies)