This is about detecting formerly benign projects that have had their pypi entries hacked, but not their private keys. It does not detect malicious projects.

And about detecting projects which dared to move their release builds away from GitHub.com/GitLab.com.