> they very frequently get malicious npm packages taken down within a day of publishing

If I'm reading the secondarily-linked blog post correctly, this was live for 12 days before discovery.