Package managers have an integrity problem
Trail of Bits found only 2 of 25 package managers (Go, vcpkg) verify every downloaded package's integrity by default.
Trail of Bits built a Docker/mitmproxy test harness to simulate a compromised package repository and tested 25 major package managers' cryptographic defenses. It found that fewer than half checked lockfile hashes by default, only Go and vcpkg verified every package's integrity, only Go verified signatures by default, and cpanminus still uses unencrypted HTTP, a known issue left unfixed to avoid a breaking change.
Why it matters
This research shows that a widely assumed baseline protection, lockfile hash verification against tampering, is inconsistently implemented or off by default across the ecosystem's most popular package managers. As attackers are pushed away from compromising individual developers, a compromised or malicious package repository becomes the next practical attack surface, and this research maps out exactly which tools would catch that and which would not.
What is verified
Trail of Bits tested 25 popular package managers against a simulated malicious package repository using a Docker/mitmproxy test harness. [1]
Fewer than half of the tested package managers used lockfiles that checked for tampering by default, and only two (Go and vcpkg) verified the integrity of every package they downloaded. [1]
Only Go verified package signatures by default among the package managers tested; others required extra configuration, lacked verification code, or did not support signatures at all. [1]
cpanminus, a commonly recommended Perl package manager, uses unencrypted HTTP by default to fetch packages, allowing an active network attacker to inject malicious code; this has been known for years and remains unfixed because switching to HTTPS would be a breaking change. [1]
The Pub package manager (Dart/Flutter) can detect a hash mismatch against pubspec.lock when fetching a package but installs the package anyway despite the mismatch. [1]
npm, pnpm, Yarn, Bun, uv, Poetry, Bundler, Cargo, and SwiftPM verify downloaded packages against hashes in their lockfiles when a lockfile is present, but this is not necessarily the default/enforced behavior without a lockfile. [1]
What is not
- The researcher tested a single package with a single package manager version on a single platform, which may not reflect the most common real-world usage patterns.
- The article is truncated and does not fully detail mitigations or recommendations beyond the examples given for Pub.
- No independent replication of these findings is cited; this is a single researcher's experimental setup.
- Unclear whether any of the affected package managers (npm, pip, Maven, Gradle, etc. used in Coding Partners' stack) have patched or plan to patch these gaps since publication.
Sources
- 1Trail of Bits Researchblog.trailofbits.com · Primary source
Original source published 14 October 2026 at 13:00.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.