Why didn't npmjs/rubygems just check failed lookup requests for "shopify-cloud" etc and block those for a while to prevent damage, and notify the companies (doing their best)? Seems like low hanging solution.