When I went to report vulnerabilities in two packages, I got a prompt "are you the maintainer of this package?". I hit no and it told me to go inform the maintainer.
I'm not sure what to tell you. I submitted a report against your package and it went through and a security ticket was opened.
Could you post some screenshots of what you are seeing?
I suspect OP conflated "I am reporting malware in a package on npmjs.com" with "I have discovered a bug or vulnerability in a package on npmjs.com." The later shows what they report[0] whereas the former does allow for a report to be made.