A 7-day package delay would have blocked installs in most short-lived malicious publish attacks from the last 8 years