Summary:
isomorphic-git (version 1.37.1) fails to verify the trailing SHA-1 checksum of .pack files. This allows corrupted or maliciously modified packfiles to be processed without error, leading to potential data corruption or parser instability. This behavior deviates from git-native and exposes users to integrity risks similar to the vulnerability recently patched in go-git (GHSA-37cx-329c-33x3).

Reproduction Steps:
dockerfile:
isomorphic-git.zip

script file:
verify_isomorphic_git_vulnerability.sh

1. Create a standard git repo.
2. Manually modify the last 20 bytes (checksum) of a .pack file.
3. Run git show HEAD using native git -> Correctly Rejected.
4. Run isomorphic-git show HEAD -> Incorrectly Accepted.

result:
https://gist.github.com/N0zoM1z0/121fe7d90c7058f0e71dc29451154b39

Impact:

• Integrity Violation: The library claims verify OK on corrupted data.
• Robustness: Potentially vulnerable to DoS attacks via malformed packfiles that bypass the checksum guard.
• Consistency: Violates the Git format specification.