Comment by reshlo

These compromises are usually caught within hours by security researchers performing automated scanning of all published packages.