Hacker News Reader

I don't think that's exactly what happened here: the compromise created new tags but generally the tag consumption relies on semantic versioning

In other words: you specify version 44, the attacker creates 44.1, you're still hosed.

View on HN

No you literally can (and the attackers did) change version 44 (the tag for it) to point to a different compromised commmit

Yes, you're right. I wasn't able to double-check as the repo was deleted at the time. That said, AIUI making the tags read-only would still often be vulnerable to semantic-version exploitation.

Reply on news.ycombinator.com