Oh yay, another package manager with absolutely no security. Let's pull and execute code from the internet with no way to validate where packages came from or if they've been tampered with.
Integrity verification of distributed packages (ideally cryptographically) is a core and required feature of a package manager.
At an absolute bare minimum you need a Lockfile style mechanism to allow users to ensure two installs are the same.
I understand your sentiment, but it's wrong. You need to take into account your userbase, potential or otherwise.
There are those which will be overzealous and not concerned about security and will use your stuff anyways, then there are those people who find themselves compelled (against their will) to use it, secure or otherwise.
Because this software strongly facilitates the later group, releasing it in this fashion represents a security risk and is unethical, wrong, even.
Just because you can manufacture a bomb does not mean you should, not should you be distributing bomb making kits.
Also, perhaps your time would be better spent building this functionality into existing package managers, rather than this one? There are certainly enough package managers out there, I'm not convinced this is even a good idea.