I'm sure 99% of all CI systems out there are just blindly doing npm install without any cache or pinned packages. Multiplied with microservices so that every run has to rebuild not just one service.

I hadn't thought of that. Internet access isn't virtually free everywhere in the world.

For the savings in data transfer, it's not worth the time to set up and kind of caching for package dependencies.

To mitigate the risk of supply chain attacks, on the other hand...