The downloaded bytes do not hash to what the release published — a corrupted or truncated transfer, or a tampered asset. Nothing has been replaced when this is thrown.
import * as Install from './install.ts'; Install.ChecksumMismatch({ asset: 'a.tar.gz', expected: 'aa', actual: 'bb' }).code; // 'UpgradeChecksumMismatch'