Alternatively, the first wave of malware stole the accounts of actual contributors. The same method was used in npm afaik.