npm ci integrity mismatch during dependency restoration

Answer

When npm ci encounters a tarball in the local cache whose SHA‑512 integrity does not match the hash recorded in package-lock.json, it treats that cache entry as corrupted, removes it from the cache, and immediately attempts to download the package again from the registry. If the freshly downloaded tarball still fails the integrity check, npm ci aborts with an integrity error and does not proceed with the installation.

Confirmed facts

• npm ci installs exactly the versions and hashes locked in package-lock.json.
• Before using a cached tarball, npm verifies its SHA‑512 hash against the lockfile.
• On a hash mismatch, the cached file is considered invalid and is deleted.
• If the re‑downloaded file also mismatches, the command fails and reports the expected and actual hashes.

Likely explanation

A corrupted cache entry usually stems from an interrupted download, a disk‑write error, or a registry mirror that served altered content. Because npm validates the hash before unpacking, the corruption is detected and the cache entry is purged, forcing a fresh fetch.

Steps to resolve the mismatch

1. Remove the existing node_modules directory (optional, as npm ci will do a clean install).
2. Run npm ci --prefer-online to bypass the cache and fetch directly from the registry, or run npm cache clean --force followed by a normal npm ci.
3. If the error persists, note the exact hash values from the error message and compare them with npm view <package>@<version> dist.shasum to determine whether the registry itself is serving the wrong tarball.

Missing diagnostic detail

To give a definitive recommendation, please share the integrity error output that shows the expected SHA‑512 hash from package-lock.json and the actual hash npm computed for the cached tarball.