Image: blog.trailofbits.com · rights & removal

Package managers have an integrity problem

Reporting by Trail of Bits BlogRead the original at blog.trailofbits.com

Executive Summary

Package managers exhibit varying levels of built-in security mechanisms for dependency integrity, primarily through cryptographic hashes and signatures. The study reviewed 25 popular package managers and found that the level of protection depends heavily on specific implementation choices, as many defaulted to insufficient verification or lacked necessary features. Lockfile-based integrity is common among some managers, demonstrated by successful correlation between lockfiles and installed dependencies in systems like Bun, npm, and Poetry. However, not all lockfile hashes provide cryptographic assurance; for instance, in Conan and CocoaPods, hashes were used primarily as unique identifiers rather than strong integrity checks against repository tampering. Signature-based security is also present but inconsistently applied; only Go verified signatures by default, while others required extra configuration. The analysis highlights a divergence in cryptographic design choices across the ecosystem, pointing toward ongoing challenges in achieving universal supply-chain integrity.

Facts Only

* Fewer than half of tested package managers used lockfiles that checked for tampering by default.
* Only two package managers verified the integrity of every downloaded package by default.
* Hash inclusion in lockfiles is common among some package managers (e.g., Bun, npm, Yarn, Cargo).
* Some systems lack dedicated lockfile features or hash verification entirely (e.g., CocoaPods, Composer, Conan).
* Only Go verified signatures by default among the tested package managers.
* cpanminus connects via unencrypted HTTP by default to its repository.
* The vcpkg package manager uses content hashes for dependencies, checked during download.
* Lockfile hashes in some systems (e.g., Conan's `conan.lock` file) serve as unique identifiers rather than cryptographic security assurances.
* Package managers like npm and NuGet require explicit configuration to enforce signature validation.
* Go’s package manager verifies checksums against a registry-signed database by default, which achieves integrity via metadata hashing.

Full Take

The observed variation in cryptographic design reveals that the challenge of package integrity is less about the inherent difficulty of cryptography and more about the complexity of integrating it into existing, developer-centric workflows. The tension between demanding immediate updates and ensuring immutable integrity, often represented by lockfile hashes, underscores a conflict between agility and assurance. The move toward identity-based signing, exemplified by Sigstore, suggests a necessary paradigm shift away from static key management towards dynamic provenance tracking. However, the persistence of systems that default to weaker verification modes—like the absence of universal signature enforcement or relying on non-cryptographic hashes—suggests systemic inertia where convenience and existing tooling outweigh rigorous security requirements unless explicitly enforced. The ultimate failure point is often in establishing a universal consensus on what constitutes sufficient integrity, pushing the responsibility onto individual developers to bridge gaps left by disparate package manager implementations.
Pattern detected: ARC-0024 Ambiguity, ARC-0043 Motte-and-Bailey

From the original · Trail of Bits Blog

I tested 25 of the most popular package managers to check whether they detect a compromised package repository injecting malicious code into legitimate packages. This code integrity problem could be solved using cryptographic hashes or signatures, but many package managers are still vulnerable to this threat.

Read the full story at blog.trailofbits.com