Security vulnerability affects the atlantis package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.