how it works

One API call replaces your install step.

Your CI pipeline sends dependency manifests. We check the cache, build if needed, and return a ready-to-extract archive. Repeat builds skip npm entirely.

Get started today Implementation guide

the full flow

Works with any CI system that can make HTTP requests.

1

Create your account

Sign up and generate an access token from the dashboard.
2

Send your manifests

Send your package.json, lockfile, Node version, and architecture.
3

We resolve the cache

Get your existing archive on a cache hit. On a first-time build we run npm ci.
4

Extract and continue

Download a tar, extract it, and run the rest of your pipeline as normal.

cache hit vs. first-run build

Both paths start the same. We determine if there is a cached build.

01 CI sends manifests + metadata
02 We determine if there is a cached build
cache check
Cache hit — repeat build
03 Existing archive found
04 CI downloads and extracts archive
First-run build — cache miss
03 No archive found → we run npm ci
04 Result archived
05 CI downloads and extracts archive

First-run builds count against your plan limits. Repeat builds are always free.

the integration in practice

Drop the nmc binary into your CI workflow and it handles the rest. Request, extraction, retries, and fallback in one go.

nmc CLI — with automatic fallback 
# Download the binary — all platforms at https://www.node-modules-cache.com/nmc-cli
curl -fsSL "https://www.node-modules-cache.com/nmc-cli/nmc-linux-amd64" \
  -o nmc && chmod +x nmc

export NMC_TOKEN="${NMC_ACCESS_TOKEN}"
export NMC_BASE_DIR="/path/to/project"
export NMC_DOCKER_IMAGE="node:22.15.0"
export NMC_ARCHITECTURE="x64"

./nmc

Prefer shell, JavaScript, PHP, or Python?

Implementation guide

Cache hits skip the registry entirely

Every live npm ci is a pull from a public registry. That creates a window where a silently replaced or compromised package could reach your build without you knowing.

When a cache hit is returned, your runner downloads a pre-built archive that was produced when the cache was warm — not a fresh pull from npm. Less registry exposure means fewer opportunities for supply chain interference to affect your pipeline.

Ready to integrate?

Start free. The implementation guide walks you through the full setup in one page.

Get started today Implementation guide