How do you "fix" that at all? In the end, there is no definition of "a source control repository that is a Go module" that is robust to this sort of "attack"..

How do you "fix" that at all? In the end, there is no definition of "a source control repository that is a Go module" that is robust to this sort of "attack"... although calling it an "attack" is kind of dubious, the reasons why this is a bad thing strike me as very strained and relatively weak. Mostly it hurts Google by hosting too much stuff, but, good luck bringing them down that way.