I find this strange, because I was pretty sure that the only way to check the installed version of a module was to load it and call ->VERSION. There isn't any database of package versions within a perl installation that I know of. Are you sure that when you load the published version 3.03 and call ->VERSION it returns '3.03'?

Meanwhile, yes the CPAN tooling does manually parse out your version rather than evaling untrusted code. One thing I have done to solve similar problems (where I needed there to be a version for testing but was injecting the real version as dist build time) was put

# VERSION
$MYPACKAGE::VERSION ||= '999';
[download]

So, let the real one come first, then apply one if it doesn't exist. Maybe just to be *really* sure tooling can't parse the bogus version, you could write it as a harder-to-parse expression, before 'use strict':

package MYPACKAGE;
# VERSION
${ __PACKAGE__ . '::VER' . 'SION' } ||= 2**10;
use strict;
[download]

---

Edit:

Oh! HAH, I remember now, I stopped doing that because I contributed the 'overwrite' option, which allows you to write

[OurPkgVersion]
overwrite = 1
[download]

package MYPACKAGE;
our $VERSION= '999'; # VERSION
[download]

and it just gets overwritten with the real version when released.