The package's phar file now matches the SHA256 from the upstream project. The problem should be fixed now.