Does npm's local cache serialize or parallelize concurrent requests for identical package versions?

Cache Concurrency Behavior

npm maintains a local package cache to avoid redundant downloads, but the documentation does not specify how the cache handles simultaneous requests for the same package version from multiple npm install or npm ci processes. In CI pipelines that run parallel jobs against a shared cache directory, or in monorepos where multiple workspaces trigger installs concurrently, the cache could become a contention point.

Lockfile and Resolution Interaction

The resolution phase calculates the full dependency tree before any network activity. If two processes resolve identical trees and then request the same tarball simultaneously, it is unclear whether npm deduplicates the fetch, queues the second request, or allows both to proceed independently. This affects both latency and cache integrity, especially when the cache is on a network filesystem.

Verification Gap

Current verification steps focus on lockfile adherence and node_modules structure, not on cache access patterns under load. The behavior may also differ between npm v6, v7+, and the upcoming v10 series.

• Does the cache implement a locking or deduplication mechanism for concurrent identical requests?
• Can concurrent cache writes corrupt metadata or cause spurious re-fetches?
• Which npm versions introduced or changed this behavior?