No checksum for packages leads to problems

I ran into this issue today when preparing my local dev environment, did a composer install and imported a DB dump from the production site, but the site is broken in my local environment.
After a lot of debugging I concluded that there must be different codes bases.

Downloaded the plugins and themes folder from production and used PHPStorm to compare it to my local installation.
Turns out that version 1.9.3 of wpackagist-plugin/wc-product-table-lite is different in wpackagist than it was when we deployed it on production.

I understand that this happened due to the plugin author messing up but it would save a lot of headaches if there was a checksum that composer could check against.
Of course one would still have to solve the issue itself but at least composer can pinpoint the problem immediately.

If someone can point me in the right direction I am willing to try and provide a PR to resolve this issue.

The issue names no files, tests, or entry points. Start by tracing how WPackagist publishes package metadata for wpackagist-plugin/wc-product-table-lite and how Composer consumes it, then determine where checksum data could be recorded and verified. Done means checksum mismatches are detected during installation and covered by tests.