Malicious packages are yanked as and when they are found or reported by the community.