package-dependency integrity check seems to be working this way