I 100% agree with you, but as i've stated a couple times here now. Once i've got the base of the system solid and working I will then implement proper security measures on-top of that. If you want to jump on-board and help out that'd be great! If you've already got an idea of how all this works then i'd be more than happy to use your expertise to make this project better. After all I am only one person so any help is welcome.

"Once i've got the base of the system solid and working I will then implement proper security measures on-top of that."

I understand your sentiment, but it's wrong. You need to take into account your userbase, potential or otherwise.

There are those which will be overzealous and not concerned about security and will use your stuff anyways, then there are those people who find themselves compelled (against their will) to use it, secure or otherwise.

Because this software strongly facilitates the later group, releasing it in this fashion represents a security risk and is unethical, wrong, even.

Just because you can manufacture a bomb does not mean you should, not should you be distributing bomb making kits.

Also, perhaps your time would be better spent building this functionality into existing package managers, rather than this one? There are certainly enough package managers out there, I'm not convinced this is even a good idea.