Wow, I also received the same phishing email even though my packages only have a few hundred downloads a week (eg. bsky-embed).

So I guess a lot more accounts/packages might be affected than the ones stated in the article

Did you receive the email in a similar time window? I'm trying to think of ways to scan other repositories for signs of compromise.