I think you should spend the 5 minutes it takes to look at the winget-pkg repo to see how it works. There's lots of great documentation.
All updates are manual, and are done via pull requests. Check everything in-queue: https://github.com/microsoft/winget-pkgs/pulls
Existing versions don't tend to have their metadata updated (I'm not sure winget would accept it). Only new versions are supported.
You can see all the checks that go into cpu-z updates with the latest PR: https://github.com/microsoft/winget-pkgs/pull/349095
In CPU-Z and HWMonitor compromisedmicrosoft
winget-pkgs
Developer Tools2020–2026
microsoft / winget-pkgs
winget-pkgs
The Microsoft community Windows Package Manager manifest repository
30Distinct people
35Mentions
0Explicit recommenders
11.3KGitHub stars
What to know before exploring
What it is
The Microsoft community Windows Package Manager manifest repository
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- microsoft/winget-cli · linked in 3 of the same discussions
- appget/appget.packages · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 12:54:37 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year35 dated mentions
Observed mentions: 2020-05-19 16:19:43 UTC to 2026-04-10 16:31:43 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 9 | 0 | 9 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 7 | 1 | 6 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 7 | 0 | 7 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Windows Package Manager Community Repository
This repository contains the manifest files for the Windows Package Manager default source. You are highly encouraged to submit manifests for your favorite application.
ImportantAt this time installers must be MSIX, MSI, APPX, MSIXBundle, APPXBundle, or .exe application installers. Font files (.ttf, .ttc, .otf, .otc, and .fnt) are also supported, although we are not currently accepting community submissions for these yet. Script-based installers are not currently supported.
The Windows Package Manager is an open source client designed for command-line usage. If you are interested in exploring private repositories offering private WinGet package hosting, see private repositories.
Documentation
Please check the overview for detailed topics. Common topics for the WinGet Community repository are available below:
Authoring a manifest
Testing a manifest
First-time contributor checklist
Submitting a manifest
Requesting a new package
Requesting a new package version
Contributing
This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.
When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Follow the instructions provided by the bot. You will only need to do this once across all Microsoft repositories using our CLA.
This project has adopted the Microsoft Open Source Code of Conduct.
See the Code of Conduct FAQ or
contact opencode@microsoft.com with any additional questions or comments. More information is available in our Contributing document.
To avoid doubt, you may not make any Submissions linking to third-party materials if such Submission is prohibited by the applicable third party and/or otherwise violates such third party's rights.
Read the full README on GitHubWhat Hacker News says
35 sourcesFor windows users, this is an advantage of using `winget` for installing things. It points to the installer hosted elsewhere, but it at least does a signature check. The config for the latest installer is listed here: https://github.com/microsoft/winget-pkgs/blob/master/manifes...
which you can install with:
winget install --exact --id CPUID.CPU-Z
(there is a --version flag where you can specify "2.19", which the signature there is a month old, so it should be safe to install that way)
In CPU-Z and HWMonitor compromisedThis is bad. I like to install software with winget. Are the versions there also compromised?
v1.63 updated 6 days ago https://github.com/microsoft/winget-pkgs/tree/master/manifes... via https://winstall.app/apps/CPUID.HWMonitor
v2.19 updated 15 days ago https://github.com/microsoft/winget-pkgs/tree/master/manifes... via https://winstall.app/apps/CPUID.CPU-Z
In CPU-Z and HWMonitor compromisedNot exactly the same situation, but RustDesk has recently been removed from the official WinGet community repository because their automated scans have been blocking updates since v1.4.2 in September 2025.
https://github.com/rustdesk/rustdesk/discussions/13025
https://github.com/microsoft/winget-pkgs/pull/345601
tl;dr: ESET Antivirus flags RustDesk as a "Potentially Unsafe Application" because it is a remote administration tool, despite not flagging similar commercial products in the same way, and the WinGet Community repo policy is to block anything flagged as such. Since they were unable to update the repo the RustDesk team requested that the older versions be removed to prevent users from unknowingly installing old versions that could potentially be a security issue in the future. Apparently this has been an issue for a lot of applic
Read the rest
ations especially in the VPN and remote control categories.
There is a discussion about how best to handle these sorts of situations where legitimate and desirable applications get flagged as "potentially unsafe" or "potentially unwanted" but so far it's just been a discussion with no actual changes proposed yet.
https://github.com/microsoft/winget-cli/issues/6107
I'm running the 1.5 Alpha for many of the reasons listed on its page: https://www.voidtools.com/everything-1.5a/ (especially Dark Mode and support for Properties/Tags/xattr/ADS/XMP)
e: also available in WinGet as `voidtools.Everything.Alpha` https://github.com/microsoft/winget-pkgs/tree/master/manifes...
In Everything – Locate files and folders by name instantlyIf you update via Winget, you are probably safe.
Winget downloads the installer from GitHub: https://github.com/microsoft/winget-pkgs/blob/master/manifes...
In Notepad++ hijacked by state-sponsored actorsI still use K-Lite Codec Pack on all of my Windows systems: https://github.com/Microsoft/winget-pkgs/tree/master/manifes...
In What you need to know before touching a video fileThese ones actually: https://github.com/microsoft/winget-pkgs/issues/304075
In Zed is now available on WindowsDocker Engine without Docker Desktop is available through winget as "Docker CLI"[1].
[1]: https://github.com/microsoft/winget-pkgs/tree/master/manifes...
In I ditched Docker for PodmanWhy can't I trust winget?
It's not hard to run the `show` command to see what a winget install will do. https://learn.microsoft.com/en-us/windows/package-manager/wi...
It's easy enough to view the manifests (eg, https://github.com/microsoft/winget-pkgs/blob/2ecf2187ea0bf1...) and arguably, is better then the protection for MITM that you would get using naked cURL & Bash, simply because there are file hashes for all of the installer files provided by a third party.
> They are saying curl is strictly better, not that it is impenetrable
Right. But it arguably is not strictly better.
> You can't trust winget
Again, this is not backed up by anything. I have trust in winget. I can trust that the manifest has at least been vetted by a human, and that the application that will be installed should be the one that I requested. I can not trust that
Read the rest
this will happen with curl | bash. If the application that is installed is not the one that I requested, there is tooling a process to sort out why that did not happen, and a way to flag it so that it doesn't happen to other users. I don't have this with curl | bash.
It is available via winget https://github.com/microsoft/winget-pkgs/tree/master/manifes...
Could be installed with
winget install Microsoft.Edit
In Edit is now open sourceWinget seems to finally do something similar for Windows: https://github.com/microsoft/winget-cli
Although the "repo" is a list of manifest files that include third-party download sources. So even if there is an approval process it seems to be quite vulnerable to including malware.
Edit: Example https://github.com/microsoft/winget-pkgs/blob/master/manifes...
In Kaspersky exposes hidden malware on GitHub stealing personal dataShowing the 15 most recent of 35 sources. Enable JavaScript to search and browse every indexed mention.