[mplewis]

OK, so it looks like you've still added suspicious code to your package.

[drdexebtjl]

You can make it much less suspicious. In particular, if you can compromise the package publishing process, and not just pushes to main, you can add your malicious code to binary artifacts, not to the source code.