Package Control protects package information in transit using TLS, verifies TLS hostnames, and requires that package metadata source URLs are HTTPS. The source

Package Control protects package information in transit using TLS, verifies TLS hostnames, and requires that package metadata source URLs are HTTPS. The source URLs for package information are all tracked in an open source repo on GitHub. For the past couple of years a volunteer who goes by the handle FichteFoll does most of the review process, and I tend to fill in when he is unavailable. We check for common packaging issues, areas of confusion for users and sometimes even code suggestions. In terms of hosting, it is all done via a private server that I run, configured to only allow TLS 1.0+ connections. I am the only user with access to the box. All of this is to say that Package Control generally tries to vet packages to get them info the default channel, and then protects them in transport. However, packages are in no way audited, and could (obviously) be subverted by anyone with access to the original source code repo/hosting.