[BUG] npm ci --omit does not remove empty folders if their name starts with @

[johenning]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

package with only one dependency:

$ cat package.json
{
  "devDependencies": {
    "@actions/core": "^1.11.1"
  }
}

omiting dev dependencies should leave the node_modules empty, but does not

$ npm ci --omit=dev

up to date, audited 1 package in 162ms

found 0 vulnerabilities
$ ls node_modules/
@actions  @fastify

it did omit some dependencies though, just not the ones starting with @, see install without omitting:

$ npm ci

added 7 packages, and audited 8 packages in 518ms

found 0 vulnerabilities
$ ls node_modules/
@actions  @fastify  tunnel  undici

Expected Behavior

omiting dev dependencies when only having dev dependencies leaves the node_modules folder empty, as is the case when the dependency does not start with @:

$ cat package.json
{
  "devDependencies": {
    "axios": "^1.7.9"
  }
}
$ npm ci --omit=dev

up to date, audited 1 package in 157ms

found 0 vulnerabilities
$ ls node_modules/
$

Steps To Reproduce

1. echo {} > package.json
2. npm i -D @actions/core
3. npm ci --omit=dev
4. ls node_modules/ observe that folder is not empty

Environment

• npm: 10.9.2
• Node.js: v22.13.0
• OS Name: Ubuntu 22.04.5 LTS
• System Model Name: Lenovo T15g Gen2
• npm config:

; node bin location = /home/jhenning/.nvm/versions/node/v22.13.0/bin/node
; node version = v22.13.0
; npm local prefix = /home/jhenning
; npm version = 10.9.2
; cwd = /home/jhenning/test
; HOME = /home/jhenning
; Run `npm config ls -l` to show all defaults.

[milaninfy]

you can check using npm ls command to see if those deps are installed or not and also check in the node_modules although there are folder name @actions it is empty.
looks like it does omit those dev dependencies, just leaves behind empty folder with that scope name

[johenning]

you can check using npm ls command to see if those deps are installed or not and also check in the node_modules although there are folder name @actions it is empty. looks like it does omit those dev dependencies, just leaves behind empty folder with that scope name

You're right, the folders are empty. Clarified the title.
In my actual usecase I was debugging something else and I stumbled over 100+ folders in node_modules when there should not have been any. So I think it still makes sense to unify the clean-up of empty folders