How to fix npm ERR! code EINTEGRITY npm ERR! Verification failed while extracting package in npm

npmINTERMEDIATEMEDIUMUpdated Dec 5, 2025· 157 views

This error occurs when npm downloads a package tarball and the calculated integrity hash doesn't match the expected hash stored in package-lock.json. npm cryptographically verifies all downloaded packages to prevent installation of corrupted or tampered packages.

Quick fix

Fixes npm ERR! code EINTEGRITY npm ERR! Verification failed while extracting package

npm cache verify
  1. Verify npm cache integrity
  2. Clear npm cache completely
  3. Remove package-lock.json and reinstall
  4. Full system reset
npm — error
npm cache verify
npm ERR! code EINTEGRITY
npm ERR! Verification failed while extracting package

What this error means

This error occurs when npm downloads a package tarball and the calculated integrity hash (SHA-512) doesn't match the expected hash stored in package-lock.json. npm cryptographically verifies all downloaded packages to prevent installation of corrupted or tampered packages. The extraction process fails because npm detects that the tarball data has been modified, corrupted, or incompletely transmitted since the package-lock.json was created. This is a security feature designed to protect against compromised or corrupted packages. Unlike checksum errors in package-lock.json metadata (which fail before extraction), this error specifically means the tarball file itself is corrupted or modified after download.

Typical symptoms

  • npm ERR! code EINTEGRITY followed by 'Verification failed while extracting'
  • npm WARN tarball tarball data for [package-name] seems to be corrupted
  • Installation stops abruptly during the extraction phase (after download completes)
  • Works on one machine but fails on another with identical package-lock.json
  • Error occurs consistently for specific packages but not others
  • CI/CD pipelines fail with this error while local development works

Common causes

  1. Corrupted local npm cache containing partially downloaded or damaged package files
  2. Network transmission errors causing incomplete or corrupted tarball downloads
  3. Package-lock.json outdated with incorrect integrity hashes
  4. Corporate proxy or firewall intercepting and modifying binary package downloads
  5. Chunked transfer encoding issues in proxy servers corrupting binary data
  6. Private npm registries with caching issues or incorrect package rebuilds
  7. npm version incompatibility with registry (sha1 vs sha512 mismatches)

How to fix "npm ERR! code EINTEGRITY npm ERR! Verification failed while extracting package"

1Verify npm cache integrity

Run npm's cache verification tool first as this often detects and fixes corrupted cache entries:

bash
npm cache verify

This command garbage collects unneeded data and verifies the integrity of cached data. It's the least destructive fix.

2Clear npm cache completely

If cache verification didn't work, force-clear all cached data:

bash
npm cache clean --force
npm install

This removes all data from the cache directory. The fresh download will generate new integrity hashes.

3Remove package-lock.json and reinstall

If the error persists, delete the package-lock.json file and allow npm to regenerate it:

bash
rm package-lock.json
npm install

This forces npm to download all packages fresh and calculate new integrity hashes. Note: this may result in different dependency versions.

4Full system reset

For stubborn cases, perform a complete reset:

bash
# Update npm to latest version
npm install -g npm@latest

# Remove node_modules and lock file
rm -rf node_modules package-lock.json

# Clear and verify cache
npm cache clean --force
npm cache verify

# Reinstall from scratch
npm install
5Check npm registry configuration

Verify you're using a reliable registry:

bash
npm config set registry https://registry.npmjs.org/

If using a private registry, verify it's not serving corrupted packages. Consider testing with the official registry first to isolate the problem.

6Check network and proxy configuration

Network issues can corrupt downloads, especially through corporate proxies:

bash
# If behind a proxy, configure it:
npm config set proxy http://proxy-server:port
npm config set https-proxy http://proxy-server:port

If using a proxy with SSL inspection, you may need to add a CA certificate. Try switching networks or disabling VPN to test.

Advanced notes

Chunked encoding vulnerability: npm versions 7-8 have a known bug where proxies using chunked transfer encoding can corrupt binary tarball data. Updating npm or disabling chunked encoding on the proxy may help.

Private registry considerations: Private npm registries sometimes cache corrupted packages or fail to invalidate cache entries when packages are republished. Clearing both the registry's cache and the local npm cache usually resolves this.

CI/CD environments: These environments often have isolated network paths, proxies, and cached registries. An EINTEGRITY error in CI but not locally suggests a network/proxy difference.

Security implications: While rare, this error could theoretically indicate a compromised registry or man-in-the-middle attack. If this occurs consistently for security-critical packages, verify the package source.

Frequently asked questions

What does "npm ERR! code EINTEGRITY npm ERR! Verification failed while extracting" mean?
json. npm cryptographically verifies all downloaded packages to prevent installation of corrupted or tampered packages. json was created.
How do I fix "npm ERR! code EINTEGRITY npm ERR! Verification failed while extracting"?
This error occurs when npm downloads a package tarball and the calculated integrity hash doesn't match the expected hash stored in package-lock.json. npm cryptographically verifies all downloaded packages to prevent installation of corrupted or tampered packages.
What causes "npm ERR! code EINTEGRITY npm ERR! Verification failed while extracting"?
Corrupted local npm cache containing partially downloaded or damaged package files Network transmission errors causing incomplete or corrupted tarball downloads Package-lock.json outdated with incorrect integrity hashes
Is the "npm ERR! code EINTEGRITY npm ERR! Verification failed while extracting" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading