Verify integrity of the downloaded content

Hey,

My name is Maciej Mensfeld, and I do supply chain security research at Mend.io.

I've noticed, that this library downloads external binaries and uses them. While it's a common pattern, integrity verification is lacking here.

This is described as [CWE-494](https://cwe.mitre.org/data/definitions/494.html).

You could verify the integrity of the downloaded file before using it by comparing the file hash to a hardcoded, expected file hash.

This is essentially what package managers do to verify the integrity of downloaded packages.

Doing this would prevent attack scenarios in which the binaries downloaded [here](https://my.diffend.io/npm/hyper-nano/1.2.0#d2h-073898-3042) are manipulated.

If the verification happens elsewhere sorry in advance and I would love it if you could point me to the location, so I can tune up my scanning engine.

Have a great day :)

Inizia tracciando i download dei binari esterni a cui fa riferimento l’issue e individua dove viene utilizzato ciascun file scaricato. Definisci gli hash attesi per quei binari e verificali prima dell’uso; il lavoro è completato quando i contenuti manipolati vengono rifiutati, mentre il flusso di download esistente continua a funzionare.

Scritto dal modello di indicizzazione a partire dal testo della issue.