Open-source repositories flooded by 144K phishing packages

> inluding NPM, PyPi, and NuGet.

So anybody can upload files to those repos ?

If yes, what could go wrong ? /s