How to fix npm ERR! code EINTEGRITY npm ERR! Tarball checksum does not match expected in npm

npmINTERMEDIATEHIGHUpdated Dec 3, 2025· 234 views

The EINTEGRITY error occurs when the downloaded package's SHA checksum doesn't match the expected value in package-lock.json. This security feature prevents installation of tampered or corrupted packages.

Quick fix

Fixes npm ERR! code EINTEGRITY npm ERR! Tarball checksum does not match expected

npm cache verify
  1. Verify npm cache
  2. Clean cache and reinstall
  3. Update npm to latest version
  4. Restore package-lock.json from working source
npm — error
npm cache verify
npm ERR! code EINTEGRITY
npm ERR! Tarball checksum does not match expected

What this error means

This error is a security feature. npm compares the SHA-512 checksum of downloaded packages against the integrity hash stored in package-lock.json. When they don't match, npm aborts installation to prevent potentially compromised packages from being installed. The mismatch can occur due to cache corruption, registry issues, or different npm versions using different hash algorithms (SHA1 vs SHA512).

Typical symptoms

  • npm install fails with integrity/checksum error
  • Docker builds fail at npm install step
  • CI/CD pipelines fail during dependency installation
  • Works locally but fails in CI (or vice versa)
  • Multiple team members unable to install

Common causes

  1. Corrupted npm cache with invalid cached packages
  2. Stale package-lock.json with outdated integrity hashes
  3. Different npm versions using different checksum algorithms
  4. Registry serving different content than when lock file was created
  5. Team members using different npm versions
  6. Network/proxy corruption during download

How to fix "npm ERR! code EINTEGRITY npm ERR! Tarball checksum does not match expected"

1Verify npm cache

Start with the least destructive fix:

bash
npm cache verify

This garbage collects corrupted data and verifies cache integrity. Try npm install again after.

2Clean cache and reinstall

If verify doesn't fix it, clean everything:

bash
# Remove local state
rm -rf node_modules package-lock.json

# Clear npm cache
npm cache clean --force

# Verify cache is clean
npm cache verify

# Reinstall (regenerates lock file)
npm install
3Update npm to latest version

Ensure consistent checksum algorithms:

bash
npm install -g npm@latest

# Then reinstall project
rm -rf node_modules package-lock.json
npm cache clean --force
npm install

npm v5 used SHA1, newer versions use SHA512. Upgrading ensures compatibility.

4Restore package-lock.json from working source

If the lock file is corrupted, restore from a known-good state:

bash
# From previous commit
git checkout HEAD~1 -- package-lock.json

# Or from main branch
git checkout main -- package-lock.json

# Then clean and install
npm cache clean --force
npm install
5Manually fix integrity value (single package)

If one package fails and you can identify the correct hash from the error:

The error shows "expected X but got Y". Open package-lock.json and find the failing package:

json
{
  "packages": {
    "node_modules/failing-package": {
      "integrity": "sha512-REPLACE_WITH_GOT_VALUE"
    }
  }
}

Replace with the "but got" value, then run:

bash
npm cache clean --force
npm install
6Use npm ci in CI/CD pipelines

For CI environments, npm ci is more reliable:

yaml
# GitHub Actions
- name: Install dependencies
  run: npm ci

npm ci strictly validates against the lock file but handles integrity verification more gracefully in CI environments.

Advanced notes

The EINTEGRITY error is a security feature—it prevents supply chain attacks where a package might be replaced with malicious code.

For team consistency:
- All team members should use the same npm version
- Add .nvmrc file to specify Node version
- Always commit package-lock.json
- Use npm ci in CI/CD instead of npm install

If using multiple registries (public + private), ensure package-lock.json was generated with the same registry configuration. Switching registries requires regenerating the lock file.

Frequently asked questions

What does "npm ERR! code EINTEGRITY npm ERR! Tarball checksum does not match expe" mean?
This error is a security feature. json. When they don't match, npm aborts installation to prevent potentially compromised packages from being installed.
How do I fix "npm ERR! code EINTEGRITY npm ERR! Tarball checksum does not match expe"?
The EINTEGRITY error occurs when the downloaded package's SHA checksum doesn't match the expected value in package-lock.json. This security feature prevents installation of tampered or corrupted packages.
What causes "npm ERR! code EINTEGRITY npm ERR! Tarball checksum does not match expe"?
Corrupted npm cache with invalid cached packages Stale package-lock.json with outdated integrity hashes Different npm versions using different checksum algorithms
Is the "npm ERR! code EINTEGRITY npm ERR! Tarball checksum does not match expe" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading