How are packages authenticated? I did an evaluation a couple of months ago but decided to drop it when I saw that packages where being pulled over plain HTTP and seemingly no authentication was being preformed.
For software build systems - my use case - this type of security lapse is a deal breaker.
For software build systems - my use case - this type of security lapse is a deal breaker.