I made a simple scanner to see if any package in a project is accessing the shell: https://github.com/Gys/cmdscanner

Recently there have also been posts on that issue in other communities. Not to be tricked by this scheme, it's worth regularly searching for copies of the public repositories. Then, if any of the malicious clones are found, report them to GitHub.