The difference is that the bug bounties are being collected from an endorsed bug bounty program. Fake and malicious packages jam public collections regularly,

The difference is that the bug bounties are being collected from an endorsed bug bounty program. Fake and malicious packages jam public collections regularly, and are not part of white hat research. It's a trash fire which seemingly only gets better with exploits forcing people to change.