[LelouBil]

Yes and no, usually when malicious packages go public it's some third party cybersecurity firm that scans packages that found it.