Bad actors practice to deceive package managers with a tangled web of methods. Here’s how to hoist them by their own petard.