Go Supply Chain Attack: Malicious Package Exploits Go Module Proxy Caching For (socket.dev)

The module cache should periodically get that the tag still matches the upstream repo. If it doesn't then show a warning when installing or on the docs page.

dup https://news.ycombinator.com/item?id=42947912