In a local nexus/nuget repository in the intranet, for sure I'm not allowing internet access directly from a CI server.
And apart from the obvious and scary security concerns it is also much faster.
Got it. You can also set up an NPM repository like that, but I don't think that that is commonly done by small dev teams. This does lead to hilarity like the left-pad clusterfork.