Why node_modules grows so quickly
Each JavaScript project can keep its own dependency tree. Monorepos, multiple package managers, native modules, and abandoned experiments can multiply the same packages across many directories. The correct cleanup target is the generated node_modules directory—not the surrounding repository.
How to judge whether a folder is inactive
- Confirm the parent contains a recognizable project manifest.
- Check recent activity across the project, not only the dependency folder’s modified date.
- Verify which package manager created the install by looking for
package-lock.json,pnpm-lock.yaml,yarn.lock, or project configuration. - Keep source files, manifests, lockfiles, patches, and package-manager configuration.
- Do not remove dependencies while a development server, build, test, or editor task is using them.
What restoration looks like
For npm projects with a matching committed lockfile, npm ci performs a clean install and does not rewrite package.json or the lockfile. npm documents that it requires the lockfile and exits if the manifest and lockfile disagree. Other package managers have their own frozen or immutable install modes; use the command expected by that repository.
SpaceLint scans only project folders you explicitly add. It stops at recognized generated directories, uses an inactivity threshold, and never selects the project root or source tree as a cleanup candidate.