{"record":{"id":"de23027eb66f120f","repo":"yarnpkg/yarn","slug":"incorrect-integrity-when-fetching-from-the-cache-f","errorCode":null,"errorMessage":"Incorrect integrity when fetching from the cache for $0. Cache has $1 and remote has $2. Run `yarn cache clean` to fix the problem","messagePattern":"Incorrect integrity when fetching from the cache for \\$0\\. Cache has \\$1 and remote has \\$2\\. Run `yarn cache clean` to fix the problem","errorType":"exception","errorClass":"SecurityError","httpStatus":null,"severity":"error","filePath":"src/package-fetcher.js","lineNumber":28,"sourceCode":"import * as promise from './util/promise.js';\n\nconst ssri = require('ssri');\n\nasync function fetchCache(\n  dest: string,\n  fetcher: Fetchers,\n  config: Config,\n  remote: PackageRemote,\n): Promise<FetchedMetadata> {\n  // $FlowFixMe: This error doesn't make sense\n  const {hash, package: pkg, remote: cacheRemote} = await config.readPackageMetadata(dest);\n\n  const cacheIntegrity = cacheRemote.cacheIntegrity || cacheRemote.integrity;\n  const cacheHash = cacheRemote.hash;\n\n  if (remote.integrity) {\n    if (!cacheIntegrity || !ssri.parse(cacheIntegrity).match(remote.integrity)) {\n      throw new SecurityError(\n        config.reporter.lang('fetchBadIntegrityCache', pkg.name, cacheIntegrity, remote.integrity),\n      );\n    }\n  }\n\n  if (remote.hash) {\n    if (!cacheHash || cacheHash !== remote.hash) {\n      throw new SecurityError(config.reporter.lang('fetchBadHashCache', pkg.name, cacheHash, remote.hash));\n    }\n  }\n\n  await fetcher.setupMirrorFromCache();\n  return {\n    package: pkg,\n    hash,\n    dest,\n    cached: true,\n  };","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/yarnpkg/yarn/blob/c2dda503f3759b5be5f0e24ecd9cf5c97a540147/src/package-fetcher.js#L10-L46","documentation":"Thrown as a `SecurityError` by `fetchCache` when the cached package's integrity (SRI) does not match the remote's declared integrity. The check runs `ssri.parse(cacheIntegrity).match(remote.integrity)`; a mismatch means the cached artifact is not what the registry vouches for, so Yarn blocks it as a potential tamper/corruption.","triggerScenarios":"A previously-cached package tarball's integrity hash differs from the remote's current integrity field. Happens after a cache write was corrupted, a registry re-published a different tarball under the same version, or the cache was manually modified.","commonSituations":"Cache corruption from a crash or disk error. A registry (or private npm proxy) republished a version with different content. Manually editing cache files. Clock/disk issues causing partial writes.","solutions":["Run `yarn cache clean` to purge the suspect cache entry, then `yarn install` to re-fetch.","If using a private registry/proxy, verify it is not serving mismatched tarballs and clear its cache too.","Confirm the package was not maliciously republished (check the registry's publish history).","Re-run with `--update-checksums` only if you trust the new remote integrity."],"exampleFix":"# before\nyarn install   # throws fetchBadIntegrityCache\n# after\nyarn cache clean\nyarn install","handlingStrategy":"fallback","validationCode":"const ssri = require('ssri');\nfunction verifyCacheIntegrity(cacheIntegrity, remoteIntegrity) {\n  if (!remoteIntegrity) return true;\n  if (!cacheIntegrity) return false;\n  return ssri.parse(cacheIntegrity).match(remoteIntegrity);\n}","typeGuard":null,"tryCatchPattern":"try {\n  return await fetchCache(dest, fetcher, config, remote);\n} catch (err) {\n  if (err instanceof SecurityError && err.message.includes('integrity')) {\n    // purge cache and re-fetch as a fallback\n    await fs.unlink(dest).catch(() => {});\n    return await fetcher.fetch({name, version});\n  }\n  throw err;\n}","preventionTips":["Periodically run `yarn cache clean` to evict stale/corrupt entries.","Pin registry content with a stable mirror (Verdaccio, Artifactory) to avoid republish drift.","Monitor for unauthorized republishes on private registries."],"tags":["security","cache","integrity","install"],"backgroundTag":null,"analyzedSha":"c2dda503f3759b5be5f0e24ecd9cf5c97a540147","analyzedAt":"2026-08-13T04:17:06.305Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}