Package managers have an integrity problem
Trail of Bits tested 25 popular package managers against a malicious repository; fewer than half verified lockfile integrity and only Go verified signatures by default.
Trail of Bits built a Docker, WireGuard, and mitmproxy-based harness simulating a compromised package repository that injects malicious code into legitimate packages. Only Go and vcpkg verified integrity of every download by default, and only Go verified signatures by default; nine managers including Maven, Composer, and R performed no lockfile verification. cpanminus also failed to validate TLS certificates. The research argues repositories become the next weakest supply-chain link as developer-compromise mitigations improve.
- Only Go and vcpkg verified integrity of every downloaded package by default
- Only Go verified package signatures without extra configuration
- Nine managers, including Maven and Composer, did no lockfile-based verification
- Test harness used Docker, WireGuard, and mitmproxy to simulate malicious repositories
- Organizations
- Trail of Bits
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | cac0f6daea041b0ccf42934163defb20 | n package manager for C and C++. "requires" : [ "zlib/1.3.1#cac0f6daea041b0ccf42934163defb20%1765284699.337" ] , This includes the package name ( zlib ) |
| sha1 | b094ded77ee97a6027ad6cf0e8c7b9f88381814c | , "url" : "https://api.github.com/repos/guzzle/psr7/zipball/b094ded77ee97a6027ad6cf0e8c7b9f88381814c" , "reference" : "b094ded77ee97a6027ad6cf0e8c7b9f88381814c" |
| sha1 | d88e31b84d65e754935053b1c584ea8e2320698a | uses the popular Files dependency. SPEC CHECKSUMS : Files : d88e31b84d65e754935053b1c584ea8e2320698a This 160-bit checksum is the SHA-1 hash of the Files Podspe |
| sha256 | 9b129329f58692f6e6578329498a8fe9fbe98f090beb764ffbb8ee2eadd01dcd | endency : "direct main" description : name : uuid sha256 : "9b129329f58692f6e6578329498a8fe9fbe98f090beb764ffbb8ee2eadd01dcd" url : "https://pub.dev" source : hosted version : "4.6.0" |
From the original article
13 min read at blog.trailofbits.com
I tested 25 of the most popular package managers to check whether they detect a compromised package repository injecting malicious code into legitimate packages. This code integrity problem could be solved using cryptographic hashes or signatures, but many package managers are still vulnerable to this threat.
By blog.trailofbits.com via equeue · blog.trailofbits.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.