I don’t think this is correct. If you’re seeing type packages in node_modules that aren’t in your package.json, they’re probably required by another library (or might be there because of VS Code’s automatic type acquisition — but I don’t think it uses your project node_modules to store the types).

You can do npm ls @types/react to see what lead to a package being installed.

If you want to ensure an end-user has access to a particular types package, TypeScript recommend explicitly requiring it.

Nice post, BTW!