x.comthreadTrail of Bits (@trailofbits) on X
Trail of Bits tweet announcing a test of 25 package managers against a simulated malicious repository. Without a lockfile only Go and vcpkg verified every download; with a lockfile fewer than half did. Replies raise that checksum verification is separate from execution isolation, and ask whether poisoned CI package caches were in the threat model.
TL;DR Trail of Bits tested 25 package managers against a malicious repo: only Go and vcpkg verified all downloads without a lockfile, and fewer than half did with one.
Technologies named here
Techniques named here
- Poisoned package cache restored in CI before install
Related in Supply Chain
