Certainly the docker repositories are vulnerable to this. If you look at a users' profile page you can see the download-count for each image.

The biggest download count becomes the most popular image, and you can script it trivially:

    docker pull skxskx/wordpress
    docker pull skxskx/wordpress
    ..
    docker pull skxskx/wordpress

It's not something that I regard as a problem, but I did notice in passing and added 50 downloads to a few of my images on evening to test the concept.

> No doubt it happens with NPM.

Could you please care to explain why?

The Java community became familiar with the term 'astroturfing' after JBoss was caught doing it.

Rot in hell, Marc Fleury

I'd have less doubt, if I were to see some examples...