Trail of Bits study finds widespread integrity flaws in package managers

A security analysis by Trail of Bits tested 25 major package managers against simulated malicious repositories. The findings show that fewer than half use lockfiles to check for tampering by default, and only two managers—Go and vcpkg—verify the integrity of every downloaded package. While HTTPS is widely used, many tools require manual configuration to enable critical cryptographic protections like signature verification or hash checking.

Cryptographic implementation gaps

• Lockfile security: Only Go and vcpkg provide full integrity verification by default; others like npm, Cargo, and Yarn require lockfiles but do not necessarily verify all contents automatically.
• Signature verification: Go is the only tested manager that verifies signatures by default; most others require extra configuration or lack support entirely.
• Protocol vulnerabilities: cpanminus was identified as a notable exception, using unencrypted HTTP by default.
• Testing methodology: The study used a custom harness with Docker and mitmproxy to simulate a compromised repository injecting malicious code into legitimate packages.

Why it matters

As developers improve security for individual packages, attackers are shifting focus toward the package repositories themselves, making automated integrity checks essential for supply-chain security.