Downloaded packages are not having their hash checked, package can attempt to run with corrupted files