Unfortunately I don't think that 2-5 instances of this will produce any change.

We've seen more than that number of actual malicious package takeovers in the last couple of years and it has produced basically no real change.

heck I did a talk describing this kind of attack 6 years ago and I found prior instances when researching that talk...