x.comthreadTrail of Bits (@trailofbits) on X
Trail of Bits post announcing research that tested 25 package managers against a simulated malicious repository serving swapped code for the same package and version. Without a lockfile only Go and vcpkg verified every download; with a lockfile fewer than half did. This undercuts the assumption that lockfiles make dependencies immutable and shows hash/integrity verification gaps across ecosystems.
TL;DR Trail of Bits found most of 25 package managers install swapped code for an identical name and version, even with lockfiles; only Go and vcpkg verified all downloads without one.
Technologies named here
Related in Supply Chain
