How to fix npm ERR! code ESHRINKWRAP npm ERR! npm-shrinkwrap.json does not match package.json in npm

npmBEGINNERMEDIUMUpdated Dec 5, 2025· 110 views

The ESHRINKWRAP error indicates that your npm-shrinkwrap.json file and package.json are out of sync, usually because package.json was modified without updating the shrinkwrap file.

Quick fix

Fixes npm ERR! code ESHRINKWRAP npm ERR! npm-shrinkwrap.json does not match package.json

# Remove both the shrinkwrap and node_modules
rm npm-shrinkwrap.json
rm -rf node_modules

# Reinstall all packages (reads from package.json)
npm install

# Regenerate a fresh shrinkwrap file
npm shrinkwrap
  1. Delete shrinkwrap and node_modules, then reinstall
  2. Run npm install to sync node_modules with package.json
  3. Check package.json for manual edits
  4. Resolve git merge conflicts in lock files
npm — error
# Remove both the shrinkwrap and node_modules
rm npm-shrinkwrap.json
rm -rf node_modules
# Reinstall all packages (reads from package.json)
npm install
# Regenerate a fresh shrinkwrap file
npm shrinkwrap
npm ERR! code ESHRINKWRAP
npm ERR! npm-shrinkwrap.json does not match package.json

What this error means

The ESHRINKWRAP error indicates that your npm-shrinkwrap.json file and package.json are out of sync with your node_modules directory. This error occurs because npm uses the shrinkwrap file to enforce strict version locking for reproducible installs, similar to package-lock.json. When npm detects that the locked versions in shrinkwrap don't match what's declared in package.json, it refuses to proceed, preventing potentially inconsistent dependency trees from being installed. This is a safety mechanism—npm is preventing you from installing a state where your actual dependencies would be ambiguous. The shrinkwrap file should be an exact record of what's installed, but if package.json has been modified (or packages added/removed) without updating the shrinkwrap, npm can't trust which version should actually be installed.

Typical symptoms

  • npm install fails immediately with ESHRINKWRAP error
  • npm ci (clean install) fails in CI/CD pipelines
  • Error message specifically mentions npm-shrinkwrap.json doesn't match package.json
  • All npm install operations fail regardless of what you're installing
  • Team members can install successfully but your local environment fails

Common causes

  1. Manual edits to package.json without updating shrinkwrap file
  2. Dependencies installed without --save flag, adding to node_modules but not updating package.json
  3. Shrinkwrap file not committed after dependency changes
  4. Conflicting package.json and npm-shrinkwrap.json from git merge
  5. Presence of both npm-shrinkwrap.json and package-lock.json causing confusion
  6. Stale shrinkwrap file from old npm version with format incompatibilities

How to fix "npm ERR! code ESHRINKWRAP npm ERR! npm-shrinkwrap.json does not match package.json"

1Delete shrinkwrap and node_modules, then reinstall

This is the most straightforward solution. It regenerates everything from scratch based on your package.json:

bash
# Remove both the shrinkwrap and node_modules
rm npm-shrinkwrap.json
rm -rf node_modules

# Reinstall all packages (reads from package.json)
npm install

# Regenerate a fresh shrinkwrap file
npm shrinkwrap

This approach is safe because you're starting from the source of truth (package.json) and creating a new shrinkwrap that matches.

2Run npm install to sync node_modules with package.json

If you want to keep the shrinkwrap file but suspect node_modules is out of date:

bash
# Update node_modules to match package.json
npm install

# Update the shrinkwrap to match what's now installed
npm shrinkwrap --save

The --save flag updates the existing shrinkwrap instead of creating a new one.

3Check package.json for manual edits

Review git history to see if package.json was modified recently:

bash
# View recent changes to package.json
git log --oneline -p package.json | head -50

# See what changed in your local copy
git diff package.json

If you made manual edits, either revert them or update properly with npm:

bash
# Revert to last committed version
git checkout package.json

# OR properly install a package
npm install --save package-name@version
4Resolve git merge conflicts in lock files

If you just merged branches and shrinkwrap is conflicted, let npm resolve it:

bash
# First resolve any conflicts in package.json manually
# Then run install with --package-lock-only to merge lock files
npm install --package-lock-only

If the merge is complex:

bash
# Accept the package.json you want
git checkout --ours package.json  # or --theirs

# Remove shrinkwrap entirely
rm npm-shrinkwrap.json

# Reinstall from scratch
npm install
npm shrinkwrap
5Consider using package-lock.json instead

If shrinkwrap keeps causing issues, modern projects typically use package-lock.json:

bash
# Delete npm-shrinkwrap.json
rm npm-shrinkwrap.json

# npm will auto-generate package-lock.json on next install
npm install

Add to .gitattributes to prevent bad auto-merges:

bash
/npm-shrinkwrap.json merge=binary

Advanced notes

When to use npm-shrinkwrap.json vs package-lock.json: npm-shrinkwrap.json is primarily intended for published packages (CLI tools, daemons) that will be installed globally—it's published to npm registry. package-lock.json is for regular projects and libraries; it's not published, giving end users flexibility on transitive dependency versions. If both files exist, npm always prefers npm-shrinkwrap.json.

Shrinkwrap best practices: Only use shrinkwrap for applications being deployed as finished products, not libraries. Run npm shrinkwrap immediately before committing—not during active development. Always commit shrinkwrap changes together with the package.json changes that caused them.

In CI/CD pipelines: Use npm ci instead of npm install—it's stricter and will catch shrinkwrap mismatches earlier.

Frequently asked questions

What does "npm ERR! code ESHRINKWRAP npm ERR! npm-shrinkwrap.json does not match" mean?
json are out of sync with your node_modules directory. json. json, it refuses to proceed, preventing potentially inconsistent dependency trees from being installed.
How do I fix "npm ERR! code ESHRINKWRAP npm ERR! npm-shrinkwrap.json does not match"?
The ESHRINKWRAP error indicates that your npm-shrinkwrap.json file and package.json are out of sync, usually because package.json was modified without updating the shrinkwrap file.
What causes "npm ERR! code ESHRINKWRAP npm ERR! npm-shrinkwrap.json does not match"?
Manual edits to package.json without updating shrinkwrap file Dependencies installed without --save flag, adding to node_modules but not updating package.json Shrinkwrap file not committed after dependency changes
Is the "npm ERR! code ESHRINKWRAP npm ERR! npm-shrinkwrap.json does not match" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading