Neowin published a security-focused guide on July 19, 2026, walking Windows 11 users through the safest way to install apps with the Windows Package Manager (winget). The key takeaway: relying on vague app names can land wrong or even malicious software on your PC. Instead, the guide urges users to search for packages, inspect their IDs, and install with the exact identifier—a deceptively simple step that thwarts an entire class of supply‑chain risks.

The Risky Ambiguity of “winget install VLC”

Typing winget install VLC feels natural, but it’s a gamble. Windows Package Manager does not enforce strict one‑to‑one name matching. When you run winget search vlc, the results often include multiple packages: the official VideoLAN version, a Microsoft Store variant, a portable fork, a preview build, and occasionally third‑party tools that happen to share a substring in their metadata. Without specifying an exact ID, winget may install whichever package its internal ranking picks first—and that choice can change across different sources or catalog updates.

Neowin’s guide highlights a concrete example: a search for “VLC” might return VideoLAN.VLC from the community repository alongside XPDM1ZHV8MQ4MB from the Microsoft Store. An unwary winget install vlc could silently install the Store variant, which may have different licensing, a sandboxed architecture, or restrictions on file associations. Worse, if a malicious actor had uploaded a package named VLCLite to the community repository, a simple name‑based install could download it without warning. The guide’s advice is unequivocal: never install an app without first inspecting its exact ID, source, and publisher.

What the Guide Recommends

The Neowin tutorial prescribes a three‑step workflow that every winget user should adopt:

  1. Search precisely. Use winget search with the --source flag to narrow results to the official community repository (winget) or the Microsoft Store (msstore). Read the Id column carefully—it is the only truly unique identifier.
  2. Inspect before you install. Run winget show --id <Package-ID> --exact to confirm the publisher, description, and the installer that winget will download for your architecture. This step alone can reveal unexpected details: some packages offer “preview” or “insider” versions that might not be what you want.
  3. Install with the exact ID. Use winget install --id <Package-ID> --exact --source <source> to eliminate any ambiguity. For community repository packages, the --exact flag ensures case‑sensitive matching; for Store packages, the Store‑specific ID is inherently exact.

The guide also warns against blind automation. Commands that suppress prompts with --silent and --accept‑package‑agreements should follow a manual inspection—not precede it. Otherwise, you might accept a license agreement from an imposter package you never meant to install.

A Growing Ecosystem Demands Caution

When winget launched in 2020 as an open‑source project, its community repository contained a few hundred curated packages. By mid‑2026, that number has swollen into thousands, with submissions from hundreds of independent maintainers. Microsoft’s own repository, winget‑pkgs, is moderated, but no automated review can catch every intentionally misleading package name. The Windows Package Manager team explicitly warns that package sources are not vetted by Microsoft; a line in the official documentation states that users should “only add sources from trusted providers.”

This is not unique to winget. Linux package managers like APT and DNF face similar challenges, but Windows users—especially those migrating from manual installer downloads—may not instinctively treat a command‑line tool with the same scrutiny. The Neowin guide comes at a moment when winget’s adoption is surging among IT professionals and power users for automated deployments, increasing the blast radius of a single mistaken install command.

What This Means for You

For home users, the takeaway is simple: build the habit of using exact IDs. It adds one more command—winget show—but prevents headaches ranging from accidental previews to malware. Neowin’s guide notes that even on a brand‑new Windows 11 PC, winget is available through the App Installer system component, so there is no friction to adopting the safer workflow from day one.

For IT administrators managing fleets of Windows 11 machines, the stakes are higher. Automated provisioning scripts often pipe winget commands into remote sessions. A script that runs winget install Notepad++ could behave differently on a machine with an updated catalog compared to one that was last synchronized weeks ago. The guide’s prescription—hardcoding exact IDs and sources in scripts—is already a best practice in enterprise environments, but the Neowin article offers a clear, public-facing rationale that admins can circulate to less technical colleagues.

For developers and open‑source maintainers, the guide is a reminder that package naming matters. A well‑chosen, unambiguous ID protects users from confusion and reduces support requests. The community repository’s manifest system supports monikers and tags to aid discoverability, but the primary ID remains the only guarantee.

How We Got Here

Winget’s journey to mainstream Windows 11 began in May 2020, when Microsoft introduced the package manager at Build. It was initially a preview, shipping as part of the App Installer update. Windows 11, released in late 2021, included a more polished version, and support was backported to Windows 10 version 1809 and later. The command‑line tool quickly gained traction because it bypassed the tedious cycle of browser downloads, manual installer wizards, and update checks.

As winget matured, the community repository evolved from a curated set of Microsoft‑verified applications to a broad, community‑driven catalog modeled after the likes of Homebrew and Chocolatey. Microsoft hired a dedicated winget engineering team, and by 2023 the tool had surpassed 10 million monthly active installations. The growth brought challenges: multiple packages with overlapping names, version‑specific variants, and the occasional malicious submission that slipped past manual review. Microsoft introduced source‑agreement acceptance and repository signing to mitigate risks, but the ultimate gatekeeper is the user’s vigilance in verifying exactly what they install.

Neowin’s July 2026 guide is not the first to advocate for exact IDs, but it arrives at a time when winget’s convenience is increasingly luring users into casual, unsafe commands. It also coincides with a broader industry push toward supply‑chain security, including Microsoft’s own Secure Supply Chain Consumption Framework (S2C2F). The timing suggests that exact‑ID discipline is shifting from “advanced tip” to “basic security hygiene.”

What to Do Now

First, test your winget installation. Open any command window (PowerShell, Command Prompt, or Terminal) and run:

winget --version

If winget is not recognized, open the Microsoft Store, search for “App Installer,” and install or update it. On newly created user accounts, the registration may require an extra command (see the official Microsoft Learn page).

Second, adopt a three‑step workflow for every single app:

  1. Search with a source filter.
    winget search <app> --source winget
  2. Inspect the candidate.
    winget show --id <Exact-ID> --exact --source winget
  3. Install using the ID.
    winget install --id <Exact-ID> --exact --source winget

For Microsoft Store apps, use --source msstore and omit --exact.

Third, harden automation scripts. If you deploy software across multiple machines, replace any plain‑name winget install lines with ID‑based commands. Always pin a specific version when consistency is critical, using the --version flag.

Fourth, verify your installed software list periodically. Run winget list --upgrade‑available to see which apps winget recognizes, and check for unexpected entries. The winget list command shows many applications installed outside winget too, but it can reveal packages you don’t remember authorizing.

Finally, if you encounter a hash mismatch or security warning, do not bypass it with --ignore‑security‑hash. Neowin and Microsoft emphasize that flag should never be used casually. Instead, refresh your sources with winget source update and retry. If the problem persists, download the installer directly from the publisher’s website.

Outlook: What to Watch Next

The Windows Package Manager team is actively working on trust‑based improvements. Public proposals on GitHub discuss pinning for community‑validated maintainers, automated signature checks, and a “verified publisher” badge that winget could display during installation. Microsoft’s own documentation hints that future versions of winget may require explicit source acceptance for newly added repositories. Until those features ship, the onus remains on users to guard their own machines. The Neowin guide, though written for Windows 11, applies equally to Windows 10 and Windows Server 2025—anywhere winget runs. As the package manager becomes embedded in Windows deployments, the mantra of “exact ID or nothing” will likely become a standard that Microsoft itself enforces by default.