There's always been the tacit assumption that using a package manager implies trust in the way that packaging is handled by that manager. Often people who handl

There's always been the tacit assumption that using a package manager implies trust in the way that packaging is handled by that manager. Often people who handle packaging dozens or hundreds of packages over years actually ARE much more aware of the security implications of decisions made by developers of individual pieces of software.