How to fix npm ERR! code EINTEGRITY npm ERR! GitHub Actions cache corrupted in npm

npmINTERMEDIATEHIGHUpdated Dec 5, 2025· 145 views

The EINTEGRITY error in GitHub Actions occurs when cached npm packages don't match the checksums in package-lock.json. The fix involves invalidating the cache, using proper cache keys, or switching to npm ci.

Quick fix

Fixes npm ERR! code EINTEGRITY npm ERR! GitHub Actions cache corrupted

- name: Cache npm packages
  uses: actions/cache@v4
  with:
    path: ~/.npm
    # Adding a version suffix forces a fresh cache
    key: ${{ runner.os }}-npm-cache-v2-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-npm-cache-v2-

Invalidate the GitHub Actions cache manually
Use dynamic cache keys based on package-lock.json
Clear npm cache and reinstall dependencies
Use npm ci instead of npm install in CI

npm — error

$- name: Cache npm packages
  uses: actions/cache@v4
  with:
    path: ~/.npm
    # Adding a version suffix forces a fresh cache
    key: ${{ runner.os }}-npm-cache-v2-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-npm-cache-v2-
npm ERR! code EINTEGRITY
npm ERR! GitHub Actions cache corrupted

What this error means

The EINTEGRITY error occurs when npm detects a mismatch between the cryptographic hash (SHA-512 checksum) of a downloaded package and the expected hash stored in your package-lock.json file. npm uses these integrity checksums to verify that packages haven't been corrupted, modified, or tampered with during download. When GitHub Actions caches npm packages or the node_modules folder, the cached versions can become stale, corrupted, or contain different package versions than what package-lock.json expects. This integrity validation failure prevents npm from installing dependencies, as accepting corrupted packages would compromise your application's security and stability. The error is particularly common when cache keys don't include a hash of package-lock.json, causing the cache to be reused even when dependencies have changed.

Typical symptoms

npm install or npm ci fails mid-workflow with 'integrity checksum failed' message
Error message shows two different SHA-512 hashes (wanted vs. got)
Build passes locally but fails in GitHub Actions CI/CD
Error only appears after GitHub Actions cache was previously working
Clearing local cache fixes the issue locally, but the problem returns in the next workflow run

Common causes

Stale GitHub Actions cache with outdated package versions—if package-lock.json is updated but old cached packages remain
Cache key doesn't include package-lock.json hash—a static cache key causes reuse even when dependencies change
Caching the wrong directory—caching node_modules directly instead of ~/.npm leads to binary compatibility issues
Package sourced from git repository with updated commits—same reference now points to different code
Corrupted cache entries from concurrent workflow jobs—matrix builds may read/write to cache simultaneously
npm version inconsistency—different npm versions may use different hash algorithms

How to fix "npm ERR! code EINTEGRITY npm ERR! GitHub Actions cache corrupted"

1Invalidate the GitHub Actions cache manually

GitHub Actions caches can become stale or corrupted. Invalidate the existing cache to force a fresh download.

Option A: Delete cache via GitHub UI
1. Go to your repository on GitHub
2. Click Actions tab
3. In the left sidebar, click Caches
4. Find the cache entry related to npm
5. Click the Delete button next to it
6. Run your workflow again

Option B: Force cache invalidation in your workflow

yaml

- name: Cache npm packages
  uses: actions/cache@v4
  with:
    path: ~/.npm
    # Adding a version suffix forces a fresh cache
    key: ${{ runner.os }}-npm-cache-v2-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-npm-cache-v2-

Incrementing v1 → v2 will force GitHub Actions to create a new cache entry.

2Use dynamic cache keys based on package-lock.json

Your cache key must include a hash of package-lock.json so that when dependencies change, the cache is invalidated automatically:

yaml

- name: Cache npm packages
  uses: actions/cache@v4
  with:
    path: ~/.npm  # Cache npm's cache directory, NOT node_modules
    key: ${{ runner.os }}-npm-cache-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-npm-cache-
      ${{ runner.os }}-

Key points:
- path: ~/.npm - Cache npm's internal cache directory (faster, OS-agnostic)
- hashFiles('/package-lock.json')** - Creates a new cache entry when dependencies change
- Never cache node_modules directly, as it contains compiled binaries specific to each OS

3Clear npm cache and reinstall dependencies

Add this to your workflow before running npm install or npm ci:

yaml

- name: Clear npm cache and verify integrity
  run: |
    npm cache clean --force
    npm cache verify

- name: Install dependencies
  run: npm ci

Full workflow example:

yaml

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '18'

      - name: Cache npm packages
        uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-npm-cache-${{ hashFiles('**/package-lock.json') }}

      - name: Clear npm cache
        run: npm cache clean --force

      - name: Install dependencies
        run: npm ci

4Use npm ci instead of npm install in CI

npm ci (clean install) is designed for CI/CD environments and respects package-lock.json strictly:

yaml

- name: Install dependencies
  run: npm ci

Why use npm ci over npm install:
- Respects exact versions in package-lock.json (no semver flexibility)
- Fails fast if package-lock.json is out of sync with package.json
- Faster and more reliable in CI environments
- Prevents "works on my machine" issues

If npm ci fails with EINTEGRITY, the issue is definitely cache-related, not a code problem.

5Ensure consistent Node.js and npm versions

Different versions of Node.js and npm use different hash algorithms. Lock down your Node version:

yaml

- name: Setup Node.js
  uses: actions/setup-node@v4
  with:
    node-version: '18.17.0'  # Use exact version, not just '18'
    node-version-file: '.nvmrc'  # Or read from .nvmrc file

Add an .nvmrc file to your repository root:

bash

18.17.0

All team members should use the same Node/npm versions locally using nvm or fnm.

6Commit package-lock.json and verify lock file consistency

Ensure package-lock.json is committed and up-to-date:

bash

# Locally: regenerate lock file with current npm
rm package-lock.json
npm install
git add package-lock.json
git commit -m "Refresh package-lock.json with current npm version"
git push

Verify lock file is in git:

bash

git ls-files | grep package-lock.json

Never delete package-lock.json as a permanent fix—it removes integrity checking entirely.

Advanced notes

GitHub Actions Cache Service Behavior:
- Cache size limits: GitHub Actions allows up to 5GB of cache storage per repository (shared across all branches)
- Cache isolation: Caches from pull requests can only read (not write to) caches from the default branch
- Concurrent job safety: When matrix jobs run simultaneously, ensure cache keys are unique per job

Performance optimization:
- Caching ~/.npm (npm's cache directory) is typically 10-50MB, compared to node_modules which can be 500MB+
- A properly configured cache with hashFiles() can reduce install time from 2-3 minutes to 30-60 seconds

Diagnosing persistent EINTEGRITY errors:
- Check the Actions tab → Caches to see if old cache entries exist
- Review workflow logs for the specific package failing and its integrity hash
- Cross-reference the hash with package-lock.json to confirm mismatch

Frequently asked questions

What does "npm ERR! code EINTEGRITY npm ERR! GitHub Actions cache corrupted" mean?: json file. npm uses these integrity checksums to verify that packages haven't been corrupted, modified, or tampered with during download. json expects.
How do I fix "npm ERR! code EINTEGRITY npm ERR! GitHub Actions cache corrupted"?: The EINTEGRITY error in GitHub Actions occurs when cached npm packages don't match the checksums in package-lock.json. The fix involves invalidating the cache, using proper cache keys, or switching to npm ci.
What causes "npm ERR! code EINTEGRITY npm ERR! GitHub Actions cache corrupted"?: Stale GitHub Actions cache with outdated package versions—if package-lock.json is updated but old cached packages remain Cache key doesn't include package-lock.json hash—a static cache key causes reuse even when dependencies change Caching the wrong directory—caching node_modules directly instead of ~/.npm leads to binary compatibility issues
Is the "npm ERR! code EINTEGRITY npm ERR! GitHub Actions cache corrupted" error serious?: Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading

📚npm Official Documentation
📖
Docs: GitHub Actions caching(Official Docs)
🐙
GitHub: actions/cache(GitHub)
💬
SO: GitHub Actions cache(Stack Overflow)

How to fix npm ERR! code EINTEGRITY npm ERR! GitHub Actions cache corrupted in npm

Quick fix

What this error means

Typical symptoms

Common causes

How to fix "npm ERR! code EINTEGRITY npm ERR! GitHub Actions cache corrupted"

Advanced notes

Frequently asked questions

Related errors

Official resources & further reading