[marsovo]

I don't think that's exactly what happened here: the compromise created new tags but generally the tag consumption relies on semantic versioning

In other words: you specify version 44, the attacker creates 44.1, you're still hosed.

[BlackFingolfin]

No you literally can (and the attackers did) change version 44 (the tag for it) to point to a different compromised commmit

[marsovo]

Yes, you're right. I wasn't able to double-check as the repo was deleted at the time. That said, AIUI making the tags read-only would still often be vulnerable to semantic-version exploitation.