How to fix npm ERR! code EINTEGRITY npm ERR! GitHub Actions cache corrupted in npm

GitHub Actions caches can become stale or corrupted. Invalidate the existing cache to force a fresh download.

Option A: Delete cache via GitHub UI
1. Go to your repository on GitHub
2. Click Actions tab
3. In the left sidebar, click Caches
4. Find the cache entry related to npm
5. Click the Delete button next to it
6. Run your workflow again

Option B: Force cache invalidation in your workflow

- name: Cache npm packages
  uses: actions/cache@v4
  with:
    path: ~/.npm
    # Adding a version suffix forces a fresh cache
    key: ${{ runner.os }}-npm-cache-v2-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-npm-cache-v2-

Incrementing v1 → v2 will force GitHub Actions to create a new cache entry.

Your cache key must include a hash of package-lock.json so that when dependencies change, the cache is invalidated automatically:

- name: Cache npm packages
  uses: actions/cache@v4
  with:
    path: ~/.npm  # Cache npm's cache directory, NOT node_modules
    key: ${{ runner.os }}-npm-cache-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-npm-cache-
      ${{ runner.os }}-

Key points:
- path: ~/.npm - Cache npm's internal cache directory (faster, OS-agnostic)
- hashFiles('/package-lock.json')** - Creates a new cache entry when dependencies change
- Never cache node_modules directly, as it contains compiled binaries specific to each OS

Add this to your workflow before running npm install or npm ci:

- name: Clear npm cache and verify integrity
  run: |
    npm cache clean --force
    npm cache verify

- name: Install dependencies
  run: npm ci

Full workflow example:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '18'

      - name: Cache npm packages
        uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-npm-cache-${{ hashFiles('**/package-lock.json') }}

      - name: Clear npm cache
        run: npm cache clean --force

      - name: Install dependencies
        run: npm ci

npm ci (clean install) is designed for CI/CD environments and respects package-lock.json strictly:

- name: Install dependencies
  run: npm ci

Why use npm ci over npm install:
- Respects exact versions in package-lock.json (no semver flexibility)
- Fails fast if package-lock.json is out of sync with package.json
- Faster and more reliable in CI environments
- Prevents "works on my machine" issues

If npm ci fails with EINTEGRITY, the issue is definitely cache-related, not a code problem.

Different versions of Node.js and npm use different hash algorithms. Lock down your Node version:

- name: Setup Node.js
  uses: actions/setup-node@v4
  with:
    node-version: '18.17.0'  # Use exact version, not just '18'
    node-version-file: '.nvmrc'  # Or read from .nvmrc file

Add an .nvmrc file to your repository root:

18.17.0

All team members should use the same Node/npm versions locally using nvm or fnm.

Ensure package-lock.json is committed and up-to-date:

# Locally: regenerate lock file with current npm
rm package-lock.json
npm install
git add package-lock.json
git commit -m "Refresh package-lock.json with current npm version"
git push

Verify lock file is in git:

git ls-files | grep package-lock.json

Never delete package-lock.json as a permanent fix—it removes integrity checking entirely.