Composer supply chain attack

Key Takeaways Packagist indexes Git tags instead of hosting artifacts, so until July 2026 a published version could be quietly repointed at a different commit. Two 2026 incidents ran that...