You have more node_modules than you think, and they are all still there

A single npm install on a modest React project writes somewhere between 200 MB and 700 MB into node_modules. That is fine. The problem is that it stays there forever, in every project you have ever cloned to look at, and nothing on the machine ever suggests removing it.

Count the project folders you have made in the last three years. Multiply by roughly 350 MB. That number is sitting on your drive right now, and almost none of it belongs to code you are still working on.

Why it gets so large

• Dependencies are not shared by default. With npm, each project gets its own full copy of every package, including the twelve copies of the same utility library that four of your dependencies each pull in at a different version.
• Nothing expires. A node_modules from a 2023 experiment is byte for byte as large today as the day it was installed.
• It is invisible in Finder. Folders do not report their recursive size unless you ask, so a 900 MB project directory looks the same as a 3 MB one.

Finding all of them

From a terminal, this lists every node_modules under your home folder with its size, largest first:

find ~ -name "node_modules" -type d -prune -print0 2>/dev/null \
  | xargs -0 du -sh 2>/dev/null \
  | sort -rh \
  | head -30

The -prune matters: without it, find descends into every node_modules it has already matched and takes minutes instead of seconds. Expect the total to be higher than your guess.

Deleting them safely

The safety property that makes this different from most disk cleaning: node_modules is fully reproducible. It is derived entirely from package.json and the lockfile, both of which are in version control. Deleting it destroys nothing, and npm install rebuilds it exactly.

The one caveat worth stating: if a project has an uncommitted patch applied inside node_modules, whether by hand or through a tool like patch-package, that change is not reproducible from the lockfile. This is rare, and you would know if you had done it.

# Remove node_modules from projects untouched for 90 days
find ~ -name "node_modules" -type d -prune -mtime +90 -print0 2>/dev/null \
  | xargs -0 rm -rf

Stopping it recurring

pnpm is the real fix if you start many projects. Its content-addressable store keeps one copy of each package version on the machine and links it into every project that needs it, which is the deduplication npm does not do. For a machine with thirty JavaScript projects the difference is tens of gigabytes.

Free Mac's Dev tab groups every node_modules on the drive by project with sizes attached, alongside Xcode DerivedData and the other build caches, so this is one pass rather than four. Scanning is free. Clearing them from inside the app is the paid part, and the find command above does the same job.