Community repo freezes new accounts after attackers swamp it with poisoned package updates