This is no different from any package registry getting some packages compromised.

Not many of them allow for immutable relases. And if they do, nothing blocks you from releasing a patch version that will most likely be automatically pulled in by many many projects during build.

The whole dependencies ecosystem is currently broken. Thats why its so easy (relatively) to attack via supply-chain.

Only way to be really secured is to have own registry of vetted dependencies pinned to exact version and maintain own upgrade pipeline.

NOONE (beside google) is going to do that. Its too costly, you need two big teams just to handle that one part.