> recently added support for package management

Are there any [plans for] supply chain attack mitigations?

Naively searching, I find https://github.com/flix/flix/issues/4380#issuecomment-123641... (Proposed Principle: A package can be declared as "safe") and https://github.com/flix/flix/issues/2837 (Add capability-safety to polymorphic effects?) the latter closed with working on something related to this https://github.com/flix/flix/issues/3000 (The Road to Algebraic Effects).