yarnpkg/yarn · error · SecurityError

Incorrect integrity when fetching from the cache for $0. Cac

Error message

Incorrect integrity when fetching from the cache for $0. Cache has $1 and remote has $2. Run `yarn cache clean` to fix the problem

What it means

Thrown as a `SecurityError` by `fetchCache` when the cached package's integrity (SRI) does not match the remote's declared integrity. The check runs `ssri.parse(cacheIntegrity).match(remote.integrity)`; a mismatch means the cached artifact is not what the registry vouches for, so Yarn blocks it as a potential tamper/corruption.

Source

Thrown at src/package-fetcher.js:28

import * as promise from './util/promise.js';

const ssri = require('ssri');

async function fetchCache(
  dest: string,
  fetcher: Fetchers,
  config: Config,
  remote: PackageRemote,
): Promise<FetchedMetadata> {
  // $FlowFixMe: This error doesn't make sense
  const {hash, package: pkg, remote: cacheRemote} = await config.readPackageMetadata(dest);

  const cacheIntegrity = cacheRemote.cacheIntegrity || cacheRemote.integrity;
  const cacheHash = cacheRemote.hash;

  if (remote.integrity) {
    if (!cacheIntegrity || !ssri.parse(cacheIntegrity).match(remote.integrity)) {
      throw new SecurityError(
        config.reporter.lang('fetchBadIntegrityCache', pkg.name, cacheIntegrity, remote.integrity),
      );
    }
  }

  if (remote.hash) {
    if (!cacheHash || cacheHash !== remote.hash) {
      throw new SecurityError(config.reporter.lang('fetchBadHashCache', pkg.name, cacheHash, remote.hash));
    }
  }

  await fetcher.setupMirrorFromCache();
  return {
    package: pkg,
    hash,
    dest,
    cached: true,
  };

View on GitHub (pinned to c2dda503f3)

Solutions

1. Run `yarn cache clean` to purge the suspect cache entry, then `yarn install` to re-fetch.
2. If using a private registry/proxy, verify it is not serving mismatched tarballs and clear its cache too.
3. Confirm the package was not maliciously republished (check the registry's publish history).
4. Re-run with `--update-checksums` only if you trust the new remote integrity.

Example fix

# before
yarn install   # throws fetchBadIntegrityCache
# after
yarn cache clean
yarn install

const ssri = require('ssri');
function verifyCacheIntegrity(cacheIntegrity, remoteIntegrity) {
  if (!remoteIntegrity) return true;
  if (!cacheIntegrity) return false;
  return ssri.parse(cacheIntegrity).match(remoteIntegrity);
}

try {
  return await fetchCache(dest, fetcher, config, remote);
} catch (err) {
  if (err instanceof SecurityError && err.message.includes('integrity')) {
    // purge cache and re-fetch as a fallback
    await fs.unlink(dest).catch(() => {});
    return await fetcher.fetch({name, version});
  }
  throw err;
}

When it happens

Trigger: A previously-cached package tarball's integrity hash differs from the remote's current integrity field. Happens after a cache write was corrupted, a registry re-published a different tarball under the same version, or the cache was manually modified.

Common situations: Cache corruption from a crash or disk error. A registry (or private npm proxy) republished a version with different content. Manually editing cache files. Clock/disk issues causing partial writes.

Related errors

• Incorrect hash when fetching from the cache for $0. Cache ha
• ENOENT
• foundErrors
• frozenLockfileError
• installCommandRenamed

AI-assisted analysis of yarnpkg/yarn@c2dda503f3 (2026-08-13). Data as JSON: /api/errors/de23027eb66f120f. Report an issue: GitHub.