Right, and they don't even confirm who might have seen that list, except that "the data on this service is consumed by third-parties who may have replicated the

Right, and they don't even confirm who might have seen that list, except that "the data on this service is consumed by third-parties who may have replicated the data elsewhere". So basically consider all private package names as of that date forever public.