Category Archives: package-manager

Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Posted on by

Does the built-in apt package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages?
My understanding was that software downloaded with apt-get packages would be cryptogra… Continue reading Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)→

Does npm (Node.js package manager) provide cryptographic authentication and integrity validation?

Posted on by

Does the npm package manager cryptographically validate its payload’s authentication and integrity for all packages after downloading them and before installing them?
I see a lot of guides providing installation instructions with steps ask… Continue reading Does npm (Node.js package manager) provide cryptographic authentication and integrity validation?→

Does yarn (Node.js package manager) provide cryptographic authentication and integrity validation?

Posted on by

Does the yarn package manager cryptographically validate its payload’s authentication and integrity for all packages after downloading them and before installing them?
I see a lot of guides providing installation instructions with steps as… Continue reading Does yarn (Node.js package manager) provide cryptographic authentication and integrity validation?→

For package managers like pip, is it a better practice to install packages with the `–user` flag?

Posted on by

I understand that for most package managers (pip, brew, TeX tlmgr, etc) packages are typically not audited, so there are some inherent security risks in using these package managers. Sometimes the package repositories aren’t trustworthy ei… Continue reading For package managers like pip, is it a better practice to install packages with the `–user` flag?→

How much damage can a malicious package do with just "npm install <package>"?

Posted on by

I had a typo and npm installed something that is similar in name to something very popular — I was concerned about typosquatting. It’s quite plausibly legitimate and just a coincidence. I looked at the corresponding package and didn’t s… Continue reading How much damage can a malicious package do with just "npm install <package>"?→

Does python’s pip provide cryptographic authentication and integrity validation?

Posted on by

Does python’s pip package manager cryptographically validate its payload’s authentication and integrity for all packages after downloading them and before installing them?
I see a lot of guides providing installation instructions with step… Continue reading Does python’s pip provide cryptographic authentication and integrity validation?→