erjtajrtwjwr

You're blindly relying on transport security currently, and that's unacceptable even when distributing your own code.

Integrity verification of distributed packages (ideally cryptographically) is a core and required feature of a package manager.

At an absolute bare minimum you need a Lockfile style mechanism to allow users to ensure two installs are the same.

Oh yay, another package manager with absolutely no security. Let's pull and execute code from the internet with no way to validate where packages came from or if they've been tampered with.