Package managers have an integrity problem

A test of 25 popular package managers found fewer than half used lockfiles that checked for tampering by default, and only two verified the integrity of every package downloaded. The review found many managers remain vulnerable to compromised repositories injecting malicious code into legitimate packages, a threat that cryptographic hashes or signatures could solve. Supply-chain attacks from developer compromise remain a common risk.