I don't know how many reported it to npm, but when I initially saw the post on HN, I took the steps to report the packages.

I don't know who to credit on this, and neither does npm but OP seems to be the source of these findings, although it would baffle me if they didn't report it to npm.