I tested 25 of the most popular package managers to check whether they detect a compromised package repository injecting malicious code into legitimate packages. Only two verified the integrity of every package they downloaded.