@iabw - thanks for pointing out the docs. That seems to be a very recent addition - glad to see the problem tackled in a non-hacky way.
Thanks for jumping in - I appreciate it. The "*" versions are just awful - I've outlawed them outright.
Ssh-ing and deleting node_modules is an obvious idea - I wish I had thought of it.
So the recommendations would be: