.npmrc

package-lock=true
shrinkwrap=true

package-one.json

{
  "name": "test-one",
  "private": true,
  "version": "1.0.0",
  "dependencies": {
    "@hapi/hapi": "npm:@commercial/hapi@^18.4.0"
  }
}

package-two.json

{
  "name": "test-two",
  "private": true,
  "version": "1.0.0",
  "dependencies": {
    "@hapi/hapi": "npm:@commercial/hapi@^18.4.0"
  }
}

package.json

{
  "name": "tmp",
  "private": true,
  "version": "1.0.0",
  "scripts": {
    "clean": "rm -rf *.tar one two",
    "preinstall": "npm run clean && mkdir -p one && cp package-one.json one/package.json && mkdir -p two && cp package-two.json two/package.json && tar cf one.tar one && tar cf two.tar two"
  },
  "dependencies": {
    "test-one": "file:one.tar",
    "test-two": "file:two.tar"
  }
}