Fix: Yarn error Integrity check failed / EINTEGRITY sha512

The Error

You run yarn install and get:

error Integrity check failed for "lodash" (computed integrity doesn't match our records)

Or variations:

error https://registry.yarnpkg.com/react/-/react-18.2.0.tgz:
Integrity check failed for "react" (computed integrity doesn't match our records, got "sha512-abc123...")

EINTEGRITY sha512-xyz... integrity checksum failed when using sha512

error An unexpected error occurred: "Integrity check failed for \"express\""

The downloaded package’s checksum does not match the checksum recorded in yarn.lock. Yarn refuses to install because the package might be corrupted or tampered with.

Why This Happens

Yarn stores integrity hashes (SHA-512 checksums) in yarn.lock to verify that packages have not changed since they were first resolved. When you run yarn install, Yarn downloads the package and compares its hash to the recorded hash.

If they do not match, Yarn aborts to protect against:

• Corrupted downloads. Network issues caused partial or corrupted package downloads.
• Corrupted cache. The local cache contains a damaged copy of the package.
• Registry-side changes. The package was republished with different content (rare but possible).
• Lock file conflicts. The yarn.lock file has incorrect entries from merge conflicts.
• Proxy/CDN issues. A corporate proxy or CDN served a cached, outdated, or corrupted response.

Fix 1: Clear the Yarn Cache

The most common fix. The cached package is corrupted:

Yarn Classic (v1):

yarn cache clean
yarn install

Yarn Berry (v2+):

yarn cache clean --all
yarn install

Clear cache for a specific package:

yarn cache clean lodash
yarn install

Find the cache directory:

yarn cache dir
# Usually ~/.cache/yarn/v6

Pro Tip: If clearing the cache does not work, also delete node_modules before reinstalling. Corrupted files in node_modules can cause the same error even with a clean cache.

Fix 2: Delete node_modules and Reinstall

A full clean reinstall:

rm -rf node_modules
rm -rf .yarn/cache   # Yarn Berry
yarn cache clean
yarn install

Nuclear option — regenerate the lock file too:

rm -rf node_modules
rm yarn.lock
yarn install

Warning: Deleting yarn.lock regenerates it from scratch, which may update package versions. Only do this if other fixes fail and you can verify the updated versions work.

Fix 3: Fix yarn.lock Merge Conflicts

Merge conflicts in yarn.lock produce invalid entries:

<<<<<<< HEAD
lodash@^4.17.21:
  version "4.17.21"
  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz"
  integrity sha512-abc...
=======
lodash@^4.17.21:
  version "4.17.21"
  resolved "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz"
  integrity sha512-xyz...
>>>>>>> feature-branch

Fixed — regenerate the lock file entry:

# Accept one side of the conflict (doesn't matter which)
git checkout --theirs yarn.lock
# or
git checkout --ours yarn.lock

# Then regenerate
yarn install

This resolves the conflict markers and regenerates the correct integrity hashes.

Common Mistake: Manually editing yarn.lock to resolve conflicts. The lock file is auto-generated — never edit it by hand. Resolve the conflict by accepting one version, then run yarn install to regenerate the correct entries.

Fix 4: Fix Registry and Network Issues

Corporate proxies or alternative registries can cause integrity failures:

Check your registry configuration:

yarn config get registry
# or for Yarn Berry:
yarn config get npmRegistryServer

Reset to the default registry:

# Yarn Classic
yarn config set registry https://registry.yarnpkg.com

# Yarn Berry
yarn config set npmRegistryServer https://registry.yarnpkg.com

If behind a corporate proxy:

yarn config set proxy http://proxy.company.com:8080
yarn config set https-proxy http://proxy.company.com:8080

Disable strict SSL (development only):

yarn config set strict-ssl false

Try using the npm registry instead:

yarn config set registry https://registry.npmjs.org
yarn cache clean
yarn install

Fix 5: Update the Integrity Hash

If a package was legitimately republished, update the hash:

# Remove the specific package from the lock file and re-resolve
yarn upgrade lodash

Or for all packages:

yarn upgrade

For a specific package version:

yarn add lodash@4.17.21

This re-downloads the package and records the new integrity hash.

Fix 6: Fix Yarn Berry (.yarnrc.yml) Issues

Yarn Berry (v2/v3/v4) uses .yarnrc.yml for configuration:

Check for enableImmutableInstalls:

# .yarnrc.yml
enableImmutableInstalls: false  # Allow modifications during install

Check for checksumBehavior:

# .yarnrc.yml
checksumBehavior: update  # Update checksums instead of failing

Other options:

checksumBehavior: ignore   # Skip integrity checks (NOT recommended)
checksumBehavior: throw    # Fail on mismatch (default)
checksumBehavior: update   # Update the lock file with new checksums

Fix 7: Fix CI/CD Integrity Failures

Integrity errors in CI often come from cache inconsistencies:

GitHub Actions — clear cache:

- name: Get yarn cache directory path
  id: yarn-cache-dir-path
  run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT

- uses: actions/cache@v4
  id: yarn-cache
  with:
    path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
    key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
    restore-keys: |
      ${{ runner.os }}-yarn-

If cache causes issues, bust the cache:

Change the cache key to force a fresh install:

key: ${{ runner.os }}-yarn-v2-${{ hashFiles('**/yarn.lock') }}
# Change v2 to v3, v4, etc. to bust the cache

Use --frozen-lockfile in CI:

yarn install --frozen-lockfile   # Yarn Classic
yarn install --immutable          # Yarn Berry

This ensures the lock file is not modified during CI builds.

Fix 8: Downgrade or Switch Package Managers

If Yarn integrity issues persist:

Try npm instead:

rm -rf node_modules
rm yarn.lock
npm install

Use a specific Yarn version:

# Check current version
yarn --version

# Set a specific version (Yarn Berry)
yarn set version 4.0.0
yarn install

Use corepack (Node.js 16+):

corepack enable
corepack prepare yarn@4.0.0 --activate
yarn install

Still Not Working?

Check disk space. Corrupted downloads can happen when disk space runs out mid-download:

df -h

Check for antivirus interference. Some antivirus software modifies downloaded files, breaking integrity checks. Add the Yarn cache directory to the exclusion list.

Check for filesystem issues. Corrupted filesystems can cause integrity mismatches. Run a filesystem check if you suspect hardware issues.

Try a different network. If the issue only happens on one network, a proxy, firewall, or ISP might be interfering with the downloads.

For Yarn general integrity check issues, see Fix: Yarn integrity check failed. For npm dependency resolution errors, see Fix: npm ERR! ERESOLVE unable to resolve dependency tree. For npm 404 errors, see Fix: npm ERR! code E404.