Not saying that the approach taken via G Drive is smart, but to your question: For a full backup of your application just storing package.json/package-lock.json

Not saying that the approach taken via G Drive is smart, but to your question: For a full backup of your application just storing package.json/package-lock.json is not enough. In case of things going south this might leave you in an unrecoverable state - imagine a package is removed for whatever reason from npm or npm becomes unreachable. Now in your risk assessment the question of course is how likely it is that you lose the copy alone your dev system, CI system and productive version at the same time that npm loses it, but the first three happening isn't as unlikely as it seems: You work on a major refactoring and while deploying you run into a major problem and want to roll back, then artifacts from the old version might be gone. Of course there are ways to prevent that. But that's the risk assessment and prevention you have to make. A full backup including node_modules is one way of dealing with that.