Security vulnerability affects the wave package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.