How to remove duplicate packages from node_modules

npm installs one copy of a package when every dependant accepts the same version. When two dependants need versions that cannot be the same, it nests a second copy under one of them. A large app can end up with dozens of these.

The two kinds this tool reports

same-major — for example 2.0.0 and 2.1.3. The copies are usually compatible, so npm dedupe can often move one version up the tree and drop the other. Fix these first.
cross-major — for example 3.9.0 and 4.3.4. These are different APIs. Fix by upgrading the dependant that holds the old one, or by pinning with an overrides entry in package.json and testing.

Checklist

Run the check on package-lock.json, once with devDependencies and once with --no-dev: only what you ship affects users.
Run npm dedupe, then the check again. Same-major entries should shrink.
For a cross-major copy, look at who requires the old version (the report names the dependant) and check whether a newer release of that dependant moves to the new major.
Use overrides only when you can test the result; forcing a version a dependant was not built for can break it silently.
Add node dupes-check.mjs --max-same-major 0 to CI so dedupable copies cannot creep back.

What this does not tell you

A lockfile records versions, not sizes, so the count of extra copies is not a byte count. Some duplicates are harmless and some, such as two copies of a library with global state, matter a lot. The list is for review; it is not a finding that anything is broken.