Dependency Confusion Attack - Dub affected?

Kagamin spam at here.lot
Fri Feb 12 08:01:10 UTC 2021

On Thursday, 11 February 2021 at 13:05:33 UTC, Jacob Carlborg 
> According to the documentation Dub will try custom registers 
> first, is that correct?

That's what most package managers do and it's not enough, see the 
author's post:

More information about the Digitalmars-d mailing list