Package managers have an integrity problem

7.8 relevance

Core platform engineering topic on software supply chain security with high actionability and community signal.

General blog.trailofbits.com

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For platform engineers managing SDLC toolchains, this reveals a critical blind spot where repository-level attacks can bypass developer-focused mitigations, directly impacting build integrity and deployment pipelines.

Key Takeaways

Audit your package manager's lockfile and signature verification defaults, and enforce strict integrity checks across your CI/CD pipelines to mitigate repository-level supply chain attacks.

Package managers have an integrity problem

Summary

Trail of Bits tested 25 package managers against malicious repository attacks, finding only Go and vcpkg verify package integrity by default. Using a Docker/mitmproxy harness, the analysis revealed fewer than half check lockfile hashes automatically and signature verification is rare, exposing the supply chain as attackers shift focus from developer compromise to repository compromise.

Author

"Keegan Ryan"