Package managers have an integrity problem

Trail of Bits tested 25 popular package managers and found fewer than half used lockfiles that checked for tampering by default, and only two verified the integrity of every package they downloaded. The research warns that a compromised package repository could inject malicious code into legitimate packages undetected.