Package managers have an integrity problem blog.trailofbits.com

Trail of Bits tested 25 package managers against repositories altered to inject malicious code, finding that only Go and vcpkg verified every downloaded package by default and fewer than half used lockfiles that checked for tampering by default. The study also found that signatures are often available but go unverified, require extra setup, or lack verification support, leaving many ecosystems exposed to repository compromise.