Those honestly sound like they're just using NPM as a platform to host their spam. All the spammers care about is that they get to host their content on a trust

Those honestly sound like they're just using NPM as a platform to host their spam. All the spammers care about is that they get to host their content on a trusted domain with a keyword-dense URL; there's no expectation that anyone actually install the package. The same problem exists on Docker Hub, e.g. https://hub.docker.com/r/neyprivedpu1972/windows-7-7264-download-iso-torrent https://hub.docker.com/r/neyprivedpu1972/windows-7-7264-down...