node_modules

npm, pnpm, and Yarn install a project's packages into node_modules. The folder is local to that project, which means a machine with many checkouts holds many copies. Given the lockfile, the package manager can recreate it. Without the lockfile, you only have whatever was declared in the manifest, which is a weaker promise.

node_modules is not the npm cache. The cache stores tarballs for reuse. The project folder stores the unpacked tree the tools import. Disk Housekeeper Smart Clean can include node_modules and previews the paths before removal. The walkthrough is Delete node_modules safely.