Many popular package managers fail to adequately protect against compromised repositories injecting malicious code. While cryptographic hashes and signatures can solve this, numerous package managers remain vulnerable. Less than half of the 25 tested managers utilized lockfiles that checked for tampering by default, and only two verified the integrity of all downloaded packages. Attackers are likely to target package repositories if developer compromises become harder to exploit. Cryptographic solutions are complex, and many implementations fall short due to design choices or resource limitations. Including cryptographic hashes in lockfiles for verification is a common approach, but its implementation varies across package managers. Only a few managers, like Go, verified package integrity by default, while others required extra configuration or lacked integral verification. Signature verification, which avoids the need for secure hash distribution, was also inconsistently implemented. Go was the only manager to verify signatures by default, with others needing additional setup or lacking signature support. The testing revealed significant variations in cryptographic designs and security levels. A testing harness using Docker and mitmproxy was developed to simulate attacks from malicious repositories. This harness dynamically evaluated package manager security against a compromised server. HTTPS is widely used by package managers, with cpanminus being a notable exception that uses unencrypted HTTP. Hash functions are intended to ensure file integrity, but the challenge lies in how the correct hash is communicated to the package manager. Vcpkg uses pre-computed content hashes stored in its source code for verification. Lockfiles are a more common method for package managers to learn correct hashes. Package managers like Bun, npm, and Cargo use lockfiles with hashes for automatic integrity checks. Some managers, like Pip and Conda, offer experimental or optional lockfile support, while others like Maven and Composer lack dedicated lockfiles. Surprisingly, some lockfiles contain hashes that do not prevent compromise, like in Pub and pnpm where mismatches might be ignored by default. Conan and CocoaPods use hashes as identifiers rather than for cryptographic integrity verification.