Package managers have an integrity problem
Summary
Trail of Bits analyzes 25 package managers to assess how well they preserve code integrity against malicious repositories. The article finds that many managers lack default cryptographic integrity checks, shows how lockfiles and signatures vary across ecosystems, and argues for a cryptographic design incorporating identity-based signing and transparency logs. It highlights Go's approach as strongest in default verification and discusses future directions for universal package signing.