An integrity error means the package npm downloaded does not match the hash recorded in your lockfile. Most causes are harmless, such as a stale cache or a registry mirror. Do not just delete the lockfile. Find out why the bytes changed first.
What the lockfile records
In package-lock.json, each entry has a resolved field that says where the package was fetched from and an integrity field. The integrity field is a Subresource Integrity string, a sha512 or sha1 hash, that identifies the exact contents of the package. When npm installs, it compares what it received to that value.
Common harmless causes
- A corrupted download or a damaged local cache.
- A private mirror or proxy that repackages tarballs.
- A lockfile merged badly by hand, leaving a hash that belongs to a different version.
- Switching registries between environments.
The cause you must rule out
A package version should be immutable on a registry. If the same name and version now produces different bytes than before, either something between you and the registry changed the file, or the registry content changed. Both deserve a look.
How to investigate
- Retry after clearing the cache with
npm cache verifyor a clean install on another machine. - Check your registry configuration and any proxy in the path.
- Compare the resolved URL in the lockfile with the one in use.
- Look at the lockfile history with
git log -p package-lock.jsonfor the entry in question. - If it fails on a clean machine with the official registry, stop and ask a colleague or the package maintainers.
What not to do
Deleting the lockfile and regenerating it makes the error vanish by accepting whatever is served now. That throws away the very check that raised the alarm. Regenerate only after you know why the hash differed.
Keep the check working
Commit the lockfile, install in CI with the command that fails on mismatch, and review lockfile changes in pull requests. A hash check is only useful if someone reads the failure.
Quick check
Is an integrity error always an attack?
No. Cache problems and mirrors cause most of them. But you should explain it before overriding it.
Can I fix it by deleting the lockfile?
That hides the symptom and drops the protection. Investigate first.
Sources
Last reviewed: 19 October 2026.
