I get the malware-infection potential, but it's still blows my mind that the fake package wasn't caught earlier by the actual users. All those downloads and nob

I get the malware-infection potential, but it's still blows my mind that the fake package wasn't caught earlier by the actual users. All those downloads and nobody wondered why X feature that depends on it wasn't working? Whatever happened to testing things and having decent coverage?