> I repeatedly see npm i change the lockfile when incrementally installing a new package that was correctly locked There's been some bugs in the implementation

> I repeatedly see npm i change the lockfile when incrementally installing a new package that was correctly locked There's been some bugs in the implementation but never had anything in the last few years, other than some people accidentally committing unapplied package.json changes, and built a precommit hook and a server-side check for that in many projects. > What do you mean ci is super fast? Is it intended to be caching the packages somewhere other than node_modules? Yes: https://docs.npmjs.com/cli/v6/commands/npm-cache#configuration https://docs.npmjs.com/cli/v6/commands/npm-cache#configurati... . If you want a more Java-like (to be more accurate, artifactory-like) experience, you can also opt-in for Verdaccio: https://verdaccio.org/ https://verdaccio.org/ You can also use the artifactory itself: https://www.jfrog.com/confluence/display/RTF/Npm+Registry https://www.jfrog.com/confluence/display/RTF/Npm+Registry I had more success with verdaccio though. Quality of the packages has been discussed to death, say about that anything you like, but npm has been rock-solid for me in the last few years. Definitely not a joke IMHO.