My bad, I thought the serializer would follow imported modules to decide which packages to include but for

node_modules

it appears to just upload whatever is in the package.json dependencies map https://www.pulumi.com/docs/intro/concepts/function-serialization/#determining-the-required-node_modules-packages