I was going to say, I've been actively working with nodejs for a few years and I've never had node_modules, package-lock.json and yarn.lock in my home dir, on e

I was going to say, I've been actively working with nodejs for a few years and I've never had node_modules, package-lock.json and yarn.lock in my home dir, on either Linux or macOS. If you run npm/yarn commands in your home dir for some reasons, then you should expect those files there. On the less than handful of times where I ran npm in my home dir accidentally, I make sure to immediately go and delete those files. It's also possible that the author runs a lot of scripts from various projects from github and sometimes those scripts' authors are not careful about running npm/yarn within their projects. I guess I don't play around with OSS enough. :)