The code on an Erlang node is loaded in memory in its own area, and sits there until it is
garbage collected. Only two copies of a module can coexist at one time, so looking for very
large modules should be easy-ish.
If none of them stand out, look for code compiled with HiPE 5. HiPE code, unlike regular BEAM code, is native code and cannot be garbage collected from the VM when new versions are loaded. Memory can accumulate, usually very slowly, if many or large modules are native-compiled and loaded at run time.
Alternatively, you may look for weird modules you didn’t load yourself on the node and panic if someone got access to your system!