The existence of a directory doesn't matter at all to how things are indexed. And subdirectories (or sub-packages) don't imply any relationship between namespaces. Claiming the package MCE::Core::Worker doesn't give you permissions on MCE::Core.
Until the latest release, there was no MCE::Core package, only a .pod file. So it was not indexed, and had no permissions attached to it. It would have been possible for a bad actor to claim that namespace and upload any tarball they wanted for it.
It is possible to control this through data in a META.json file, but usually that data is automatically generated. And it can still be confusing for a dist to claim it provides a module that doesn't actually exist because it's only a .pod file.
In reply to Re^4: Any reason to have documentation-only *.pm file instead of *.pod for CPAN distro?
by Haarg
in thread Any reason to have documentation-only *.pm file instead of *.pod for CPAN distro?
by Anonymous Monk
For: | Use: | ||
& | & | ||
< | < | ||
> | > | ||
[ | [ | ||
] | ] |