I'm not sure what countermeasures that project has in place, but there are plenty of articles exploring malicious packages found there.