package name and version string are part of what, the metadata manifest provided right? As a thought experiment, say a collision is found for libc or the stand

package name and version string are part of what, the metadata manifest provided right? As a thought experiment, say a collision is found for libc or the standard library, thanks to all that research on primes that's been released recently, assume a more efficient search is found. What would the failure domains be for those two libraries if, a) the library was non-functional suddenly, or b) the library remained functional but malicious. Would Nix detect the collision, or would Nix simply recreate the dependency graph overwriting the old but secure with this new malicious software. Almost all of the security primitives are implemented at domain edges, which means local access, or remote exploitation would have equal effect, and a watering hole/supply chain attack may not even be necessary.