Package managers have an integrity problem

Summary: Trail of Bits tested 25 popular package managers against a simulated malicious repository and found fewer than half used lockfiles that checked for tampering by default, while only two verified the integrity of every package downloaded. Only Go verified signatures by default, and cpanminus was the sole package manager using unencrypted HTTP by default, allowing any active network attacker to inject malicious code.
What's compelling: If developers of popular packages become harder targets, attackers will shift to the package repositories that serve the code - and most of the 25 package managers tested would not stop a compromised repository from injecting malicious code into legitimate packages.

Read the original at Trail of Bits Blog ↗