Corporations use pypi and npm, I think they don't care about being compromised.