{"record":{"id":"6e02bd7b5d77865b","repo":"pnpm/pnpm","slug":"invalid-tarball-integrity","errorCode":"INVALID_TARBALL_INTEGRITY","errorMessage":"Tarball \"${dist.tarball}\" has invalid shasum specified in its metadata: ${dist.shasum}","messagePattern":"Tarball \"(.+?)\" has invalid shasum specified in its metadata: (.+?)","errorType":"exception","errorClass":"PnpmError","httpStatus":null,"severity":"error","filePath":"pnpm11/resolving/npm-resolver/src/index.ts","lineNumber":1275,"sourceCode":"    code: MINIMUM_RELEASE_AGE_VIOLATION_CODE,\n    reason: `was published at ${new Date(ts).toISOString()}, within the minimumReleaseAge cutoff (${args.publishedBy.toISOString()})`,\n  }\n}\n\nfunction getIntegrity (dist: {\n  integrity?: string\n  shasum: string\n  tarball: string\n}): string | undefined {\n  if (dist.integrity) {\n    return dist.integrity\n  }\n  if (!dist.shasum) {\n    return undefined\n  }\n  const integrity = ssri.fromHex(dist.shasum, 'sha1')\n  if (!integrity) {\n    throw new PnpmError('INVALID_TARBALL_INTEGRITY', `Tarball \"${dist.tarball}\" has invalid shasum specified in its metadata: ${dist.shasum}`)\n  }\n  return integrity.toString()\n}\n\n/**\n * Construct the LRU `PackageMetaCache` instance the resolver uses by\n * default. Exported so the install layer can build one cache and hand\n * the same reference to both the resolver and the verifier — the\n * verifier's fast path reads from it when the resolver has already\n * fetched a packument during the same install.\n */\nexport function createDefaultPackageMetaCache (): PackageMetaCache {\n  return new LRUCache<string, PackageMeta>({\n    max: 10000,\n    ttl: 120 * 1000, // 2 minutes\n  })\n}\n","sourceCodeStart":1257,"sourceCodeEnd":1293,"githubUrl":"https://github.com/pnpm/pnpm/blob/6261b7f388016d57ca6b90340342411cd1d0d00f/pnpm11/resolving/npm-resolver/src/index.ts#L1257-L1293","documentation":"When registry metadata has no `dist.integrity` SRI field, pnpm reconstructs one from `dist.shasum` with ssri.fromHex. If the shasum is not parseable hex (wrong length, non-hex characters, or mangled metadata), the integrity value cannot be built and pnpm rejects the tarball record rather than installing something with an unusable checksum. The message names the offending tarball URL and shasum so you can trace which registry served it.","triggerScenarios":"getIntegrity receives a dist object where integrity is absent and shasum is malformed — typical of private registries/proxies that rewrite packuments (Verdaccio/Nexus plugins), hand-rolled registries, or a mirror bug — e.g. shasum truncated or base64 instead of hex.","commonSituations":"Corporate npm proxies that recompute metadata incorrectly; a company registry fed by a broken replication job; publishing pipelines that strip dist.integrity; npm-mirror CDNs serving stale or corrupted packuments.","solutions":["Identify the source from the tarball URL in the message — the host tells you which registry/mirror served the bad metadata","Fix the publishing/proxy side so dist.shasum is the 40-char hex sha1 of the tarball, or emit a proper dist.integrity SRI string","Clear the cached packument so pnpm refetches corrected metadata: delete the package's entry under <cacheDir>/metadata (then reinstall)","If the package exists on npmjs.org, install that dependency from the canonical registry to bypass the broken mirror"],"exampleFix":"// before — packument served by the broken mirror\n\"dist\": { \"tarball\": \"https://npm.corp/foo/-/foo-1.0.0.tgz\", \"shasum\": \"cafe0xyz\" }\n\n// after — valid 40-char hex sha1 (or add dist.integrity SRI)\n\"dist\": { \"tarball\": \"https://npm.corp/foo/-/foo-1.0.0.tgz\", \"shasum\": \"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0\" }","handlingStrategy":"try-catch","validationCode":"const HEX40 = /^[0-9a-f]{40}$/i\nexport function assertDistIntegrityUsable (dist: { integrity?: string, shasum?: string, tarball: string }) {\n  if (dist.integrity) return\n  if (!dist.shasum) return // undefined integrity is allowed by the resolver\n  if (!HEX40.test(dist.shasum)) {\n    throw new Error(`Registry ${new URL(dist.tarball).host} serves malformed shasum \"${dist.shasum}\" for ${dist.tarball}`)\n  }\n}\n// run over packuments coming from private registries/proxies in your smoke tests","typeGuard":"function isInvalidTarballIntegrity (err: unknown): err is Error & { code: 'ERR_PNPM_INVALID_TARBALL_INTEGRITY' } {\n  return typeof err === 'object' && err !== null &&\n    (err as { code?: string }).code === 'ERR_PNPM_INVALID_TARBALL_INTEGRITY'\n}","tryCatchPattern":"try {\n  await resolveNpm(wantedDependency, opts)\n} catch (err) {\n  if (isInvalidTarballIntegrity(err)) {\n    // err.message contains the tarball URL and bad shasum — report which registry is broken,\n    // clear the packument cache for that package, then retry from the canonical registry\n    await clearMetadataCache(spec.name)\n    return resolveNpm(wantedDependency, { ...opts, registry: 'https://registry.npmjs.org/' })\n  }\n  throw err\n}","preventionTips":["Smoke-test your private registry/proxy: every served packument needs dist.integrity (SRI) or a 40-char hex dist.shasum","Don't hand-edit or recompute dist fields in registry plugins without matching the tarball bytes","Pin installs of critical packages to a trusted registry so a broken mirror cannot serve mangled metadata"],"tags":["integrity","shasum","registry-metadata","npm-registry","security"],"backgroundTag":"invalid-integrity-metadata","analyzedSha":"6261b7f388016d57ca6b90340342411cd1d0d00f","analyzedAt":"2026-08-17T18:30:54.750Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}