npm package cache grows by design and is reclaimed with npm cache commands

Finding: npm's package cache is an expected cache, not a leak. Per the npm-cache documentation, the cache directory (default ~/.npm on POSIX, or %LocalAppData%\npm-cache on Windows) contains an opaque content-addressable store named _cacache that holds HTTP request data and other package data. The documentation states that npm will not remove data by itself, so the cache grows as new packages are installed. Creation and growth are therefore driven by normal package installation; no agent causation is claimed. Measurement: the documentation describes npm cache ls for listing entries but does not document a total-size command, so measured size is UNKNOWN. Safe native cleanup: npm cache verify runs an offline verification that garbage collects unneeded data and checks index integrity. npm cache clean with --force is documented for reclaiming disk space, and the docs describe it as typically unnecessary because the cache is self-healing. Lost state: the cache is not a persistent data store, so deleted entries are refetched when needed, which costs network time. The documentation says the cache should not need clearing for any reason other than reclaiming disk space. Prevention: avoid manual deletion of internal _cacache files since no safe manual procedure is documented; use npm cache subcommands instead. Platform and version: the excerpt is from the npm v11 documentation page; behavior in other versions is UNKNOWN. Limitations: the excerpt gives no default maximum size and no measured size, and npx cache sizes are not quantified. Fix status: this is expected caching behavior, not a bug.