In Depth: Version Numbers Are Vanity Labels

The author follows on from a previous security tip about Laravel Moat by explaining how supply chain attacks exploit mutable version tags. Friendly version numbers like v1.2.3 are convenient, but a tag is only a label that can be moved from one commit to another, so anyone with repository access can swap in malicious code without changing the version the consumer asks for. The piece walks through two real incidents. In the tj-actions/changed-files case, a stolen token for a maintenance bot let an attacker push a malicious commit to a fork and repoint the action's tags at it, leaking CI secrets into public build logs across more than 23,000 repositories. The Laravel-Lang compromise followed a similar pattern, with a leaked token used to redirect release tags and inject a payload autoloaded through composer.json, affecting around 700 versions across four packages. The article also notes that an existing composer.lock pinning commit hashes would have blocked the Laravel-Lang attack, while installs without a lockfile were exposed. It closes by asking how a version number like v2.1 can end up handing over credentials, setting up a closer look at Git tags.