top | item 43374891 (no title) BlackFingolfin | 11 months ago No you literally can (and the attackers did) change version 44 (the tag for it) to point to a different compromised commmit discuss order hn newest marsovo|11 months ago Yes, you're right. I wasn't able to double-check as the repo was deleted at the time. That said, AIUI making the tags read-only would still often be vulnerable to semantic-version exploitation.
marsovo|11 months ago Yes, you're right. I wasn't able to double-check as the repo was deleted at the time. That said, AIUI making the tags read-only would still often be vulnerable to semantic-version exploitation.
marsovo|11 months ago