npm ERR! code EINTEGRITY

What This Error Means

npm downloaded a package tarball whose checksum did not match the expected integrity value (lockfile/metadata mismatch).

How to Fix It

1. Check which registry npm is using: npm config get registry.
2. If the package is scoped, verify scope registry mapping in .npmrc (example: @your-scope:registry=...).
3. Verify the npm cache first: npm cache verify (then retry).
4. If package-lock.json exists, remove node_modules and run npm ci (do not delete the lockfile unless you intend to regenerate it).
5. If you do not have a lockfile, run npm install to generate one intentionally and commit it (then CI can use npm ci).
6. If cache verification does not help, force a re-download: npm cache clean --force (then retry).
7. If using a proxy registry, confirm it is fully synced and not serving mixed metadata/tarballs for the same version.

Why It Happens

• The npm cache contains a corrupted tarball (common after interrupted downloads).
• A proxy/cache registry served stale metadata or a different tarball for the same version.
• Network middleboxes (proxies, antivirus) modified or truncated the tarball download.

How to Verify

1. Re-run the install and confirm EINTEGRITY no longer appears.
2. If you are using a proxy registry, verify installs succeed both with and without cache warm state.

Manual checksum validation

1. Get the expected integrity and tarball URL: npm view <pkg>@<version> dist.integrity dist.tarball.
2. Download the tarball and compute SHA-512: curl -L <tarball-url> -o pkg.tgz && openssl dgst -sha512 -binary pkg.tgz | openssl base64 -A.
3. Compare the computed value to the sha512-... integrity string.
4. If you have a proxy registry, repeat the same check against the proxy and the upstream registry.

Common CLI Output

npm ERR! code EINTEGRITY

npm ERR! sha512-<hash> integrity checksum failed when using sha512: wanted <hash> but got <hash>

How npm verifies package integrity

1. npm stores expected SRI integrity values in the lockfile and/or registry metadata.
2. During install, npm downloads the tarball and verifies its checksum before extracting.
3. If the downloaded bytes do not match the expected checksum, npm throws EINTEGRITY.

Prevention Tips

• Prefer deterministic installs (npm ci) in CI when you have a lockfile.
• Use a reliable proxy/cache registry and monitor sync health.
• Avoid force-publishing or mutating tarballs for an existing version.

Where This Can Be Triggered

      this.emit('error', err)
    } else if (this.sri && !match) {
      const err = new Error(`${this.sri} integrity checksum failed when using ${this.algorithm}: wanted ${this.digests} but got ${newSri}. (${this.size} bytes)`)
      err.code = 'EINTEGRITY'
      err.found = newSri
      err.expected = this.digests
      err.algorithm = this.algorithm