NPM registry prank leaves developers unable to unpublish packages

Could threat actors leverage “dependency hell” to exploit open-source software repositories?

dependency developers exploit npm open-source software packages registry repositories software supply chain third-party-code threat threat actors