Last friday we merged  which refactored the default location where package sources are fetched. Until then, they were fetched in the application build directory, e.g. in "<app directory>/bin/pkg/<board>/<pkg name>". This was inefficient because packages were fetched each time the application was built for a new board and thus was consuming unnecessary disk space.
The new strategy is now to fetch the package sources in a global and unique location, under "$(RIOTBASE)/build/pkg/<pkg name>". This way the packages are fetched only once, during the very first build of an application that requires them. The fetched source are not duplicated anymore, so this saves disk space.
Note that this new strategy is only possible when the packages are built "out-of-source": when all build files (*.o, *.a, etc) are created outside of the package source tree. The RIOT build system and CMake allows for that so packages built with the RIOT module mechanism (with "include $(RIOTBASE)/Makefile.base" somewhere) or CMake can benefit from the global location. This is the case for most of the available packages in RIOT, except Micropython (custom Makefile) and OpenThread (autotools). For those two, the build uses the old behavior: packages are fetched and build within the application build directory.
If you have worked on implementing a new package for RIOT, you'll have to rebase and adapt your package Makefile. The change is minimal, use other existing packages as examples.
If you have any comments or questions, feel free to ask here.