Comment by Pooge

Makes me think of the "cobra effect", like the Great Hanoi Rat Massacre.[1]

Set arbitrary metrics like download count -> bad actors make bots to download their package -> they profit while the registry suffers from very heavy load.

[1]: https://en.wikipedia.org/wiki/Great_Hanoi_Rat_Massacre