npm and pnpm Caches: Where Gigabytes Hide in AppData

Two tools, two caching models

npm keeps a content-addressable cache at %LOCALAPPDATA%\npm-cache: every tarball it ever downloaded, plus logs and the _npx cache for one-off package runs. None of it is needed to keep installed projects working — it exists purely to make future installs faster and offline-friendly. pnpm works differently: a single store (in recent versions at %LOCALAPPDATA%\pnpm\store) holds the real files, and every node_modules folder in every project is built from hard links back to it. That's why pnpm projects don't multiply disk usage the way npm ones do — and why the store itself grows without limit: each new package version lands there permanently until you prune.

The result is a familiar surprise: you delete an old project, the space doesn't come back, because the hard links in the store keep the data alive. The thing to check is the store, not the project folders.

The cleanup commands worth knowing

Everything here is safe by design — caches are caches, and the tools rebuild them on demand:

• npm cache clean --force — wipes the whole npm cache; the next installs re-download what they need
• npm cache verify — the gentler option: garbage-collects and checks integrity instead of nuking
• pnpm store prune — removes packages from the store that no project links to anymore
• Delete %LOCALAPPDATA%\npm-cache\_npx — throwaway caches from npx runs, always safe to drop
• npm config set cache D:\dev\npm-cache — moves the cache off your SSD to a data drive, permanently
• Measure first: a size scan of AppData beats deleting blind — npm-cache and the pnpm store are the two usual suspects

The NTFS hard-link gotcha

Here's the part that confuses everyone: on NTFS, a file's data is freed only when the last hard link to it disappears. Delete your pnpm store right after cleaning out node_modules, and you free what you expect. Delete the store while projects still link to its files, and you free nothing — the bytes stay on disk as long as node_modules exists, and Explorer keeps showing store entries that are effectively empty husks. So the order matters: remove the projects (or their node_modules) first, then run pnpm store prune. CI runners and machines that churn through many repositories benefit most from doing this monthly; on a single-project laptop the store rarely justifies the attention.

Questions and Answers

Read next