Package manager caches on a Mac: npm, pnpm, yarn, pip, Gradle, Cargo, CocoaPods, and the commands that clear them

Package managers optimise for the next install being fast. The way they do it is to keep every artefact they ever downloaded. Nothing expires. After a year of work the caches on a working Mac are routinely 10 to 20 GB, spread across a dozen hidden folders, none of which Storage settings will name.

All of them share one property: delete the cache, and the next install re-downloads exactly what it needs. That is the definition of safe.

The folders and the commands

Tool	Where on macOS	Clear it
npm	~/.npm/_cacache	npm cache clean --force
pnpm	~/Library/pnpm/store	pnpm store prune
yarn 1	~/Library/Caches/Yarn	yarn cache clean
yarn 2+	~/.yarn/berry/cache	yarn cache clean --all
pip	~/Library/Caches/pip	pip cache purge
Homebrew	~/Library/Caches/Homebrew	brew cleanup --prune=all
CocoaPods	~/Library/Caches/CocoaPods and ~/.cocoapods/repos	pod cache clean --all
Swift PM	~/Library/Caches/org.swift.swiftpm	swift package purge-cache
Gradle	~/.gradle/caches	delete the folder
Cargo	~/.cargo/registry	delete registry/cache and registry/src
Go	~/Library/Caches/go-build	go clean -cache
Dart / Flutter	~/.pub-cache	dart pub cache clean

See your own numbers:

du -sh ~/.npm ~/Library/pnpm ~/Library/Caches/Yarn ~/Library/Caches/pip \
  ~/Library/Caches/Homebrew ~/Library/Caches/CocoaPods \
  ~/Library/Caches/org.swift.swiftpm ~/.gradle ~/.cargo ~/.pub-cache \
  ~/Library/Caches/go-build 2>/dev/null | sort -rh

Three that deserve a note

pnpm is the exception to "just delete it". Its store is content-addressed and every project's node_modules hard-links into it. pnpm store prune removes packages no project references; deleting the whole store would leave existing projects with dangling links until you reinstall. Use the command.

Gradle keeps wrapper distributions under ~/.gradle/wrapper/dists, one full Gradle install per version any project has ever asked for. That folder is often bigger than the caches. Each distribution re-downloads on the next build of a project that needs it.

Cargo has no built-in cache clean. ~/.cargo/registry/cache holds the downloaded crates and registry/src the unpacked sources; both regenerate. ~/.cargo/bin is your installed tools and stays.

What is not a cache

• node_modules inside a project is not a cache, though it comes back with one install. Deleting it in projects you are not working on frees more than any cache does.
• ~/.cargo/bin, ~/.pub-cache/bin, global npm packages under ~/.npm-global or /usr/local/lib/node_modules are installed tools.
• ~/.gradle/gradle.properties, ~/.npmrc, ~/.cargo/config.toml are settings.

Where Decruft fits

Decruft's System Data pane lists each of these stores with its measured size under one heading, so you see npm next to Gradle next to Cargo rather than hunting through dotfolders. Everything on this page is labelled safe, since each one rebuilds itself. Scanning is free; the commands above do the rest if you prefer.