Package managers have an integrity problem

Keegan Ryan built a harness (Docker plus a mitmproxy addon) that simulates a compromised package repository rewriting legitimate downloads, then ran 25 package managers through it on default settings. Fewer than half used lockfile hashes that catch tampering by default, and only two (Go and vcpkg) verified the integrity of every package. Some lockfile hashes protect less than they appear to: Pub installs after a hash mismatch unless told otherwise, CocoaPods hashes the Podspec rather than the code it points to, and Composer's commit hashes do not cover the ZIP. Only Go verifies signatures by default. The proposed fix is for lockfiles to pin a publisher identity or key instead of one exact hash, backed by a transparency log, so integrity stops fighting with taking security updates. His comparison is that package signing today is where HTTPS was a decade ago. For us the practical takeaway is to know exactly which of these guarantees your own toolchain gives you, because the defaults vary more than most people assume.