For starters, packages should probably be considered non-transferable. If someone buys a package, they shouldn't keep the existing rankings and ratings.
It would be challenging to be proactive about it, but it was be a clear solution when they get caught.
The problem is that no one reviews what goes in the package registries. Unless someone spots the security issue it goes unnoticed and unfixed. Particularly true with new and not very popular packages.
To be fair to the author though this package won't take more than a couple of hours review quickly for potential back doors and if you just want one data structure it's at most in 3 files.
A "vetted" package index that charges subscription and splits the revenue with package maintainers. In return, maintainers agree to jump through all the extra hoops and index maintainers do extra verification (but still no warranty except that the standard procedure is followed).
The same package can then be uploaded to the normal index (as it is now), but without these extra steps, and no vetting.
It would be challenging to be proactive about it, but it was be a clear solution when they get caught.
reply