A dependency proxy serves a cached package manifest after the source package was revoked, and downstream builds keep resolving the unsafe version

Upstream fixed the issue, but the local acceleration layer preserved the vulnerable metadata view.