explainer
Trail of Bits tests 25 package managers: only Go and vcpkg verify every package
A Trail of Bits audit of 25 package managers found fewer than half check lockfile integrity by default and only two verify every package they fetch — a direct supply-chain risk for crypto tooling.