Is It Safe to Delete node_modules? Find and Clear Them

What node_modules is and why it adds up

When you run npm install, pnpm install or yarn, the package manager downloads every dependency listed in package.json, plus their dependencies, into a node_modules folder next to it. Nothing in it is written by you: it is a local, reproducible copy of code that lives on the npm registry.

A single modern front-end project easily pulls in hundreds of megabytes. Multiply that by every tutorial, prototype, client project and cloned repo on your Mac and the total often reaches tens of gigabytes, most of it in projects you have not opened in months.

Find every node_modules folder

Point find at the folder where you keep your code. -prune stops it from descending into a node_modules it has already found, so nested ones inside packages are not listed separately.

# every node_modules under ~/code, with its size, smallest first
find ~/code -type d -name node_modules -prune -exec du -sh {} + 2>/dev/null | sort -h

# the total for all of them
find ~/code -type d -name node_modules -prune -print0 | xargs -0 du -sch | tail -1

Is it safe to delete node_modules?

Yes, for a normal project. Everything in node_modules can be downloaded again. What decides whether you get back the same dependencies is the lockfile next to package.json:

• package-lock.json for npm, pnpm-lock.yaml for pnpm, yarn.lock for Yarn.
• With a lockfile, a reinstall gives you the exact versions the project was last working with.
• Without one, the package manager resolves the newest versions allowed by the ranges in package.json. An old project may then install different versions than before, and sometimes it no longer builds.

So before you delete, check that the project has a lockfile and that it is committed. To reinstall exactly what the lockfile says, use the strict install command of your package manager:

npm ci
pnpm install --frozen-lockfile
yarn install --frozen-lockfile   # Yarn 1
yarn install --immutable         # Yarn 2 and later

npm ci refuses to run when package-lock.json is missing or out of sync with package.json, and it removes any existing node_modules before installing. That makes it a good test: if npm ci works, the project is fully restorable.

Things that are lost when you delete node_modules: any manual edits you made inside it (a quick patch to a dependency, for example) and the time it takes to reinstall. If you rely on patched dependencies, keep them with a tool like patch-package so the patch lives in the project instead.

Delete them by hand

For one project, delete the folder from the project root:

cd ~/code/old-project
rm -rf node_modules

For many projects, write the list to a file first, read it, remove the lines you want to keep, then delete what is left:

find ~/code -type d -name node_modules -prune > ~/node_modules-list.txt
open -e ~/node_modules-list.txt   # review and edit the list
while IFS= read -r dir; do rm -rf "$dir"; done < ~/node_modules-list.txt
rm ~/node_modules-list.txt

Monorepos and workspaces

In a monorepo that uses npm, Yarn or pnpm workspaces, there is a node_modules at the root and often more inside each package. They belong together. The find command above lists all of them; delete them as a group and reinstall once from the repository root, not from inside one package.

pnpm works differently from npm: files in a pnpm node_modules are hard links into a shared store. Deleting a pnpm project's node_modules therefore frees less space than du reports for that folder, because the files stay in the store as long as another project uses them.

The npm and npx cache in ~/.npm

Besides the per-project folders, npm keeps a global cache in ~/.npm. ~/.npm/_cacache holds downloaded package tarballs, which is why reinstalling a deleted node_modules is usually faster than the first install. ~/.npm/_npx holds packages that npx fetched to run a command once, such as project generators.

du -sh ~/.npm ~/.npm/_cacache ~/.npm/_npx

# check the cache and garbage-collect unneeded data
npm cache verify

# empty the whole cache (npm requires --force)
npm cache clean --force

# recent npm versions can list and remove npx entries
npm cache npx ls
npm cache npx rm

Clearing the cache is safe. The cost is that the next installs download everything again, and --prefer-offline installs will not work until the cache refills. pnpm and Yarn have their own stores: pnpm store path shows where pnpm keeps its store and pnpm store prune removes packages no project references; yarn cache clean empties Yarn's cache.

If you also work with Flutter or Xcode, those leave similar rebuildable folders: see freeing disk space in Flutter projects and clearing Xcode DerivedData.

Doing it with CleanDev

CleanDev scans the project folders you choose and lists each node_modules that sits next to a package.json, with its size. Projects without a lockfile are not selected automatically; they are shown for review with the reason, so you decide. The full edition also clears the npm and npx caches. CleanDev Lite, free on the Mac App Store, covers the project folders.