Comment by Rp8yXmdmr

There is a cascading effect when malware targets developers and uses stolen credentials to push more infected packages. And not everyone is even aware they were affected, so there are going to be additional data leaks discovered some time after initial infection wave.