I think most of that can be chalked up to someone simply mistakenly running those commands in the wrong directory (root of $HOME). I've never heard of a JS app

I think most of that can be chalked up to someone simply mistakenly running those commands in the wrong directory (root of $HOME). I've never heard of a JS app just randomly storing a global node_modules or yarn.lock to the root of $HOME.