That's correct, orphaned packages could be adopted seemingly automatically, so someone did and then published malware in bulk.