Furthermore, it doesn't appear that any of these fad language repositories do any sort of package signing, so you're vulnerable not just to the people who upload their own code, but anyone who may compromise the mirrors, too, because even if you trust the source, there's no way of verifying the code hasn't been modified on the mirror.

See also: http://cristianobetta.com/blog/2013/02/02/ruby-gems-are-not-...