Victor's room

Overview & Root Cause Summary: The error npm ERR! code EINTEGRITY integrity checksum failed when using sha512: wanted <hash1> but got <hash2> / Verification failed while extracting <package>@<version> occurs during npm install when the cryptographic SHA-512 hash of a downloaded package tarball does not match the integrity signature recorded in package-lock.json or npm’s global cache. The primary culprits are corrupted local package cache entries from interrupted downloads, lockfile merge conflicts, or corporate proxy registries modifying package archive metadata.

Understanding the Root Causes

• Corrupted Local Package Cache: An incomplete download or network interruption cached a damaged package tarball in ~/.npm/_cacache, causing subsequent extraction integrity checks to fail.
• Desynchronized package-lock.json After Git Merge: Merging branches in version control inadvertently combined a newer package version definition with an older SHA-512 integrity string.
• Proxy Registry Archive Alteration: Internal artifact repositories (such as Nexus, Artifactory, or Verdaccio) or network inspection proxies re-compressing tarballs or caching altered metadata.
• Upstream Package Re-publishing (Unpublished/Replaced): In rare instances, a package maintainer unpublishes and re-publishes the same version tag with different contents on a private registry.

Step 1: Quick Fix (Force Clean npm Cache & Reinstall)

Purge npm’s local cache store to remove damaged package archives and force a fresh cryptographic download from the registry.

# 1. Force clean npm's global cache:
npm cache clean --force

# 2. Verify that npm's cache store is completely verified and intact:
npm cache verify

# 3. Retry installing dependencies:
npm install

Step 2: Clean Reinstallation of Lockfile and Modules

If the integrity mismatch originates from a corrupted or conflicting package-lock.json, regenerate the lockfile cleanly.

# 1. Remove local node_modules and the conflicting lockfile:
rm -rf node_modules package-lock.json

# (On Windows PowerShell):
# Remove-Item -Recurse -Force node_modules, package-lock.json

# 2. Force clean the cache once more:
npm cache clean --force

# 3. Perform a fresh installation to generate a synchronized lockfile:
npm install

Step 3: In-Place Lockfile Checksum Refresh & Registry Verification

If you cannot discard the entire lockfile due to strict version freezing, update only the lockfile checksums without modifying dependencies.

# Option A: Refresh only the integrity checksums in package-lock.json without reinstalling modules:
npm install --package-lock-only

# Option B: Verify active registry endpoint to ensure requests are not redirected:
npm config get registry

# Option C: If using a custom proxy, bypass proxy cache by testing public PyPI / npm directly:
npm install --registry=https://registry.npmjs.org

Verification & Testing Steps

Confirm that npm’s cache verification reports zero corruption and that project scripts build cleanly.

# 1. Verify npm cache contents and integrity:
npm cache verify

# 2. Check top-level dependency tree:
npm list --depth=0

# 3. Run application build or test script:
npm test

Summary Comparison Table

Troubleshooting Approach	Target Root Cause	Lockfile Modification	Recommended Scenario
npm cache clean --force	Damaged local tarball in cache	None (Preserves lockfile)	First response for local download glitches
Delete Lockfile & Reinstall	Git merge conflict in lockfile	Complete lockfile regeneration	Discrepancies after Git branch merges
--package-lock-only	Outdated hash with fixed versions	Updates SHA-512 hashes in-place	Strict team repos with frozen dependency trees
Explicit Registry Flag	Corporate proxy archive drift	None	Internal Nexus/Artifactory cache synchronization delays