How to fix npm ERR! code EBADSHRINKWRAP npm ERR! Invalid shrinkwrap file in npm

npmBEGINNERMEDIUMUpdated Dec 5, 2025· 95 views

The EBADSHRINKWRAP error occurs when npm detects structural or data inconsistencies in the npm-shrinkwrap.json file, typically from corruption, platform-specific dependencies, or conflicting versions.

Quick fix

Fixes npm ERR! code EBADSHRINKWRAP npm ERR! Invalid shrinkwrap file

# Remove node_modules and all lock files
rm -rf node_modules npm-shrinkwrap.json package-lock.json

# Perform a clean install
npm install

# Regenerate the shrinkwrap file
npm shrinkwrap
  1. Delete and regenerate lock files
  2. Run npm prune before regenerating
  3. Clear npm cache and reinstall
  4. Verify package.json and lock file are in sync
npm — error
# Remove node_modules and all lock files
rm -rf node_modules npm-shrinkwrap.json package-lock.json
# Perform a clean install
npm install
# Regenerate the shrinkwrap file
npm shrinkwrap
npm ERR! code EBADSHRINKWRAP
npm ERR! Invalid shrinkwrap file

What this error means

The EBADSHRINKWRAP error occurs when npm detects structural or data inconsistencies in the npm-shrinkwrap.json file (or package-lock.json). This typically happens when the lock file doesn't match the actual packages installed in node_modules, or when the lock file itself becomes corrupted. The shrinkwrap file serves as a precise record of which package versions should be installed, so when npm detects discrepancies, it halts the installation process to prevent unpredictable behavior. This is a safety mechanism, though the error message doesn't always clearly indicate the root cause. This issue is common when working across different operating systems (macOS to Linux), different npm versions, or after interrupted installations.

Typical symptoms

  • Installation fails immediately with EBADSHRINKWRAP error before any packages are installed
  • Works on one developer's machine but fails on another (especially across different operating systems)
  • Error appears after switching between different npm or Node.js versions
  • Intermittent failures that seem random, occurring on second or third runs of npm install
  • CI/CD pipelines fail consistently while local development works fine

Common causes

  1. Extraneous or missing packages in node_modules that don't match npm-shrinkwrap.json
  2. Platform-specific dependencies (shrinkwrap generated on macOS includes fsevents, fails on Linux)
  3. Lock file corruption from incomplete writes, merge conflicts, or manual editing
  4. Multiple shrinkwrap regenerations causing idempotent failures
  5. Dependency version conflicts with empty or unresolvable version requirements
  6. npm and Node.js version mismatches (lockfileVersion differences between npm 6 and npm 7+)

How to fix "npm ERR! code EBADSHRINKWRAP npm ERR! Invalid shrinkwrap file"

1Delete and regenerate lock files

Remove the corrupted lock file and node_modules, then reinstall:

bash
# Remove node_modules and all lock files
rm -rf node_modules npm-shrinkwrap.json package-lock.json

# Perform a clean install
npm install

# Regenerate the shrinkwrap file
npm shrinkwrap

This forces npm to fetch fresh dependency metadata from the registry and creates a clean lock file.

2Run npm prune before regenerating

If you still have node_modules but the lock file is stale:

bash
# Remove extraneous packages
npm prune

# Regenerate the shrinkwrap file
npm shrinkwrap

npm prune removes packages from node_modules that aren't listed in package.json, eliminating "extraneous" packages that cause EBADSHRINKWRAP errors.

3Clear npm cache and reinstall

Cached package metadata can sometimes be stale or corrupt:

bash
# Clear the npm cache completely
npm cache clean --force

# Remove lock files and node_modules
rm -rf node_modules npm-shrinkwrap.json package-lock.json

# Reinstall everything
npm install
4Verify package.json and lock file are in sync

Ensure package.json and lock file match:

bash
# Ensure package.json and lock file match
npm install

# Check that installation succeeded completely
npm ls

# If no errors, regenerate the lock file
rm npm-shrinkwrap.json
npm shrinkwrap

Run npm ls to see the full dependency tree and identify any issues.

5For cross-platform teams, use package-lock.json instead

If your team works across different operating systems, avoid npm-shrinkwrap.json:

bash
# Remove npm-shrinkwrap.json (it takes precedence)
rm npm-shrinkwrap.json

# Let npm generate package-lock.json on install
npm install

# Commit package-lock.json instead
git add package-lock.json
git commit -m "Use package-lock.json for cross-platform compatibility"

package-lock.json handles cross-platform dependencies better than shrinkwrap.

6Ensure consistent npm and Node.js versions across the team

Version mismatches can cause lockfileVersion incompatibilities:

bash
# Add a .nvmrc file to specify Node.js version
echo "18.0.0" > .nvmrc

# Team members update to match
nvm install $(cat .nvmrc)
npm install --global npm@9

Create a .nvmrc file specifying your Node.js version and document the required npm version in your README.

Advanced notes

Why npm-shrinkwrap.json is problematic: The npm-shrinkwrap.json feature has a fundamental design issue—it's included when publishing packages to npm, meaning shrinkwraps from published packages can lock downstream consumers to incompatible versions. Many organizations avoid using npm-shrinkwrap.json entirely in favor of package-lock.json, which is only used locally.

Idempotency issues: npm's original implementation of shrinkwrap had a critical flaw: running npm shrinkwrap multiple times without modifying package.json could produce different results. Modern npm versions have improved this, but it's still a reason to avoid regenerating shrinkwrap files unnecessarily.

Legacy peer dependencies: If you have legacy-peer-deps=true configured globally or in .npmrc, this can cause npm to silently accept incompatible peer dependencies and modify the lock file in ways that break CI builds.

Frequently asked questions

What does "npm ERR! code EBADSHRINKWRAP npm ERR! Invalid shrinkwrap file" mean?
json). This typically happens when the lock file doesn't match the actual packages installed in node_modules, or when the lock file itself becomes corrupted. The shrinkwrap file serves as a precise record of which package versions should be installed, so when npm detects discrepancies, it halts the installation process to prevent unpredictable behavior.
How do I fix "npm ERR! code EBADSHRINKWRAP npm ERR! Invalid shrinkwrap file"?
The EBADSHRINKWRAP error occurs when npm detects structural or data inconsistencies in the npm-shrinkwrap.json file, typically from corruption, platform-specific dependencies, or conflicting versions.
What causes "npm ERR! code EBADSHRINKWRAP npm ERR! Invalid shrinkwrap file"?
Extraneous or missing packages in node_modules that don't match npm-shrinkwrap.json Platform-specific dependencies (shrinkwrap generated on macOS includes fsevents, fails on Linux) Lock file corruption from incomplete writes, merge conflicts, or manual editing
Is the "npm ERR! code EBADSHRINKWRAP npm ERR! Invalid shrinkwrap file" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading