I sometimes wish those developers who have a lapse in sanity (left-pad, faker.js, etc.) would just do this to their most popular repos instead of poisoning the software supply chain.