Self-Healing CI: Recovering npm EINTEGRITY on a Corrupt Cache
An EINTEGRITY mismatch means npm pulled a cached tarball whose checksum did not match -- clearing the cache and reinstalling fixes it every time.
The problem
An npm install/npm ci fails with EINTEGRITY because a cached package tarball did not match its expected checksum. The lockfile and the published package are fine; a cache entry was written partially or corrupted. A human clears the npm cache and re-runs, and the install passes unchanged.
npm error code EINTEGRITY
npm error sha512-... integrity checksum failed when using sha512: wanted ... but got ...Why it happens
npm verifies each downloaded or cached tarball against the integrity hash in the lockfile. If a cache entry was truncated by an interrupted previous job, or storage returned a partial object, the bytes no longer match the expected hash and npm refuses them.
It is mechanical and self-correcting: discarding the bad cache entry and re-fetching the package from the registry produces a matching tarball, with no change to your dependencies.
The manual fix
The manual fix is to clear the cache and reinstall:
- Verify/clean the npm cache (
npm cache verifyornpm cache clean --force). - Remove the corrupted cache directory if needed, then re-run the install.
- Confirm the next install restores a valid cache before relying on it.
npm cache clean --force
rm -rf ~/.npm/_cacache
npm ciHow this gets automated
An EINTEGRITY failure has a clear integrity-error signature, and the remedy is deterministic: discard the bad cache entry and re-fetch from the registry. A self-healing CI pipeline detects the corruption, evicts the affected cache, retries so the package is re-downloaded cleanly, and only escalates if the mismatch recurs against a fresh fetch, which would indicate a real upstream problem.