The issue only happens if the package manager platform is hacked rather than an individual package maintainer's credentials. The latter usually requires a new v

The issue only happens if the package manager platform is hacked rather than an individual package maintainer's credentials. The latter usually requires a new version to be pushed which people will notice and ask about (it's happened before). If the package manager platform is hacked then you're in trouble unless you employ a lock file.