Trail of Bits: Only 2 of 25 Package Managers Verify All Downloads by Default

Trail of Bits tested 25 popular package managers by simulating a compromised repository with mitmproxy. Only Go and vcpkg verified the integrity of every downloaded package by default, and only Go checked signatures by default.

• Only Go and vcpkg verified integrity of all packages by default
• Fewer than half used lockfiles for default tamper checks
• Only Go verified signatures by default
• Bun, Cargo, npm, pnpm, uv and Yarn verify only when lockfiles are present