Great point. I think that Maven Central is great about checking incoming packages. But most maven clients are really bad. The default in maven client is usuall

Great point. I think that Maven Central is great about checking incoming packages. But most maven clients are really bad. The default in maven client is usually to download via http. The default is usually to _not_ check the hash. There is not a great way to pin a library to a repository which, when coupled with the ease of third-party repositories slipping into your project, means that you can download things like your crypto oauth library from some random server on the web. Many of these issues can be mitigated by running your own repository that mirrors what you need. Most big corporate shops do this. I think that approach works for any package management system. I guess open source devs and hobbiests are screwed?