diff --git a/controllers/sync_module_worker.js b/controllers/sync_module_worker.js
index 49ab4d053..7b9bf8958 100644
--- a/controllers/sync_module_worker.js
+++ b/controllers/sync_module_worker.js
@@ -1325,7 +1325,7 @@ SyncModuleWorker.prototype._syncOneVersion = function *(versionIndex, sourcePack
   var downurl = sourcePackage.dist.tarball;
   var urlobj = urlparse(downurl);
   var filename = path.basename(urlobj.pathname);
-  var filepath = common.getTarballFilepath(filename);
+  var filepath = common.getTarballFilepath(sourcePackage.name, sourcePackage.version, filename);
   var ws = fs.createWriteStream(filepath);
 
   var downloadOptions = {
diff --git a/lib/common.js b/lib/common.js
index b629d3f94..34fda6c5f 100644
--- a/lib/common.js
+++ b/lib/common.js
@@ -2,13 +2,16 @@
 
 var crypto = require('crypto');
 var path = require('path');
-var config = require('../config');
+var utility = require('utility');
 var util = require('util');
+var config = require('../config');
 
-exports.getTarballFilepath = function (filename) {
+exports.getTarballFilepath = function (packageName, packageVersion, filename) {
   // ensure download file path unique
   // TODO: not only .tgz, and also other extname
-  var name = filename.replace(/\.tgz$/, '.' + crypto.randomBytes(16).toString('hex') + '.tgz');
+  var name = filename.replace(/\.tgz$/, '.' + crypto.randomBytes(16).toString('hex'));
+  // use filename string md5 instead, fix "ENAMETOOLONG: name too long" error
+  name = packageName.replace(/\//g, '-').replace(/\@/g, '') + '-' + packageVersion.substring(0, 20) + '.' + utility.md5(name) + '.tgz';
   return path.join(config.uploadDir, name);
 };