I'll note that crates.io accounts are backed by GitHub accounts. Have the authors of these crates been reported to GitHub (at least to notify them in the case of hijacking, banning in the case of nefarious deeds)?