Comment Re:Increment the version ya nubs. (Score 1) 9
The attacker did release updated versions but your other comment suggests you already realized that but I'll explain for anyone else.
They removed the hacked versions and rolled the project version back to the good version. I'm saying they should increment the version number of the clean version to be higher than the hacked versions so the systems which had already installed the compromised packages will recognize the clean version as newer and having priority over the hacked one. In some cases automatic updates might even cause the hacked version to be replaced with a clean one automatically.
The desire to 'detect' an attack [or at least that they were temporarily vulnerable so they can look for one] is the only case for not doing that which I can think of. My contention is that minimizing the window of vulnerability at scale is more critical, anyone who is looking to see if they were running the vulnerable version is exactly the level of informed they'd need to be know to look at logs which indicate they HAD been running the vulnerable version. The vast majority probably aren't informed and won't check anything and they'll sit vulnerable until the compromise triggers some kind of alarm or the version number finally organically increments over what the attacker used.