PACKAGE MANAGERS HAVE AN INTEGRITY PROBLEM

Summary from the TLDR InfoSec newsletter

If efforts to reduce supply chain attacks via developer compromise succeed, attacks will shift to attacking package registries as the next weakest link. Some package managers store hashes in a lock file. However, they often use these for purposes other than cryptographic integrity. Similarly, support for signatures is not consistent and often not verified by default.