Tag open-source package vulnerabilities