Audit of 25 Package Managers Shows Only Two Verify Every Package's Integrity Against Compromised Repositories

Trail of Bits tested 25 of the most widely used package managers to see whether they would notice a compromised repository serving malicious code instead of the legitimate package. Cryptographic hashes or signatures can protect code integrity, yet many managers remain vulnerable due to design choices, resource constraints, or usability trade-offs.

Lockfile Integrity Checks

Placing a cryptographic hash of package contents in a lockfile and verifying it after download is the most straightforward defense. Roughly half of the tested managers enable this check by default. The rest require extra configuration, use hashes in a cryptographically unsafe manner, or omit them entirely.

Go and vcpkg verify integrity on every download. Bun, Bundler, Cargo, npm, pnpm, Poetry, SwiftPM, uv, and Yarn perform checks when a lockfile is present. Conda, Gradle, Pip, NuGet, and Pub require additional steps beyond a standard lockfile. CocoaPods, Composer, Conan, cpanminus, Gem, Maven, PowerShellGet, PSResourceGet, and R do not verify integrity even with lockfiles or lack lockfile support altogether.

Signature Verification

Only Go verifies signatures by default. Bundler, Gem, Gradle, Maven, npm, and NuGet support signatures after manual configuration. The remaining managers either lack verification code or do not support signatures at all.

Experimental Setup

The researcher built a test environment using Docker containers and mitmproxy to dynamically intercept and modify responses from simulated malicious repositories. A WireGuard tunnel routed traffic so the proxy could fully control plaintext responses while the root certificate remained trusted inside the containers. Tests used latest versions, default flags, and popular packages from public repositories.

Almost every manager uses HTTPS and validates certificates. The notable exception is cpanminus, which still defaults to unencrypted HTTP. Several managers store hashes in lockfiles yet fail to enforce them strictly. Pub warns about hash mismatches but still installs the package unless the non-default --enforce-lockfile flag is used. Older versions of pnpm exhibited similar behavior. Conan relies on MD5-based recipe revisions that are not intended for cryptographic integrity. CocoaPods and Composer protect Git references or commit hashes but cannot detect malicious content served under the same tag or archive URL.

The study concludes that lockfiles serve multiple purposes beyond supply-chain security, and current hash-based approaches sometimes conflict with the desire for rapid security updates. Several communities are actively working on improved schemes.