Audit of 25 Package Managers Shows Only Two Verify Every Package's Integrity Against Compromised Repositories
Trail of Bits tested 25 of the most widely used package managers to see whether they would notice a compromised repository serving malicious code instead of the legitimate package. Cryptographic hashes or signatures can protect code integrity, yet many managers remain vulnerable due to design choices, resource constraints, or usability trade-offs.
Lockfile Integrity Checks
Placing a cryptographic hash of package contents in a lockfile and verifying it after download is the most straightforward defense. Roughly half of the tested managers enable this check by default. The rest require extra configuration, use hashes in a cryptographically unsafe manner, or omit them entirely.
Go and vcpkg verify integrity on every download. Bun, Bundler, Cargo, npm, pnpm, Poetry, SwiftPM, uv, and Yarn perform checks when a lockfile is present. Conda, Gradle, Pip, NuGet, and Pub require additional steps beyond a standard lockfile. CocoaPods, Composer, Conan, cpanminus, Gem, Maven, PowerShellGet, PSResourceGet, and R do not verify integrity even with lockfiles or lack lockfile support altogether.
Signature Verification
Only Go verifies signatures by default. Bundler, Gem, Gradle, Maven, npm, and NuGet support signatures after manual configuration. The remaining managers either lack verification code or do not support signatures at all.
Experimental Setup
The researcher built a test environment using Docker containers and mitmproxy to dynamically intercept and modify responses from simulated malicious repositories. A WireGuard tunnel routed traffic so the proxy could fully control plaintext responses while the root certificate remained trusted inside the containers. Tests used latest versions, default flags, and popular packages from public repositories.
Almost every manager uses HTTPS and validates certificates. The notable exception is cpanminus, which still defaults to unencrypted HTTP. Several managers store hashes in lockfiles yet fail to enforce them strictly. Pub warns about hash mismatches but still installs the package unless the non-default --enforce-lockfile flag is used. Older versions of pnpm exhibited similar behavior. Conan relies on MD5-based recipe revisions that are not intended for cryptographic integrity. CocoaPods and Composer protect Git references or commit hashes but cannot detect malicious content served under the same tag or archive URL.
The study concludes that lockfiles serve multiple purposes beyond supply-chain security, and current hash-based approaches sometimes conflict with the desire for rapid security updates. Several communities are actively working on improved schemes.
Related articles
Compromised ConnectWise Credential Used to Access 173 Microsoft 365 Environments in Supply Chain Attack
A compromised credential from ConnectWise Cloud Backup, formerly known as SkyKick Backup, was abused to access at least 173 partner and customer Microsoft 365 environments. Microsoft Threat Intelligence classified the incident as an active supply chain attack. The attacker bypassed password and multi-factor authentication by using a client assertion issued from the vendor environment, impersonating an already-approved application identity to obtain Microsoft Graph tokens. Access occurred on October 15 between 06:13 and 08:34 UTC, with the intruder enumerating environment identifiers sequentially at short intervals, indicating automated scripting against a prepared target list. The backup application's permissions covered Exchange, OneDrive, SharePoint, Teams, and directory information. In one environment, another vendor application was granted global administrator rights and planted secrets in two trusted applications valid until 2028. ConnectWise later disabled seven application identities, revoked affected certificates, and suspended Cloud Backup services.
OIDC Configured but GitHub Actions Still Vulnerable: Megalodon and actions-cool Attacks Expose Runner Risks
Even after widespread adoption of OIDC for temporary cloud credentials in GitHub Actions, two major attacks in May 2026 demonstrated that the approach remains insufficient on its own. Attackers compromised actions-cool/issues-helper by substituting action tags to execute malicious commits that read Runner.Worker memory. The Megalodon campaign injected malicious workflows into 5,561 public repositories, harvesting environment variables, credential files, kubeconfig, SSH keys, and OIDC tokens. OIDC eliminates long-lived AWS_ACCESS_KEY_ID secrets but leaves short-lived tokens exposed inside the runner during job execution. Four mandatory protection layers are now required: strict cloud trust policies using StringEquals on the sub claim, job-level id-token: write permissions, outbound traffic controls such as Harden-Runner, and CODEOWNERS enforcement on .github/workflows/. GitHub Environments with mandatory reviewers add an essential human-approval gate that would have disrupted the Megalodon attack path.
GitHub Repo Trap with 1774 Stars Mimics Microsoft Activation Scripts to Deliver Malware via Telegram Bot
A security researcher built a Telegram bot that daily delivers five trending GitHub repositories from trendshift.io along with README summaries. One repository named Microsoft Activation Scripts contained only a README with a reversed PowerShell command that decoded to download and execute a payload from a lookalike domain. The account was created 94 seconds before the repository and used classic one-liner installation syntax to blend with legitimate projects. Analysis of 321 trending repositories showed that simple filters such as recent account age or irm|iex patterns would incorrectly flag many legitimate projects including codex and opencode. Two independent detection rules were developed: one that normalizes and scans for obfuscated execution commands including base64, mshta, certutil and hidden window flags, and another that flags one-time owners created less than 30 days before the repository with under 10 KB of content. An additional groundedness check using the AIHOT method prevents DeepSeek from inserting unverified claims such as Ruby or Cypress into repository summaries.
GhostAction Campaign Expands to Inject Malicious GitHub Workflows Stealing AWS Keys and Tokens
The GhostAction campaign has returned with an expanded technique that targets a wider range of credentials across hundreds of repositories. On October 8, two compromised maintainer accounts injected a malicious workflow named security-audit.yml into 346 GitHub repositories, including high-profile projects such as uber/athenadriver and kitao/pyxel. The workflow disguises itself as a security audit routine and executes automatically on every code push, exfiltrating credentials via HTTP requests to attacker-controlled servers. Unlike previous waves that only harvested GitHub Actions secrets, the new version also scans the working directory and full git history for forgotten credentials in older commits. Targeted data includes AWS access keys, GitHub and GitLab tokens, Google API keys, Slack and SendGrid tokens, OpenAI and Anthropic credentials, PyPI passwords, and crates.io tokens. Since October 7, more than 500 GitHub accounts have planted similar workflows, building on earlier campaigns that affected 817 repositories in September 2025 and 772 between August and September.