npm download counts on the packages page are being gamed. An attacker published 22 versions of pi-screenshots-picker in 7 days and used a download inflation tool that targets a fixed ~100-120 downloads per version. Since npm counts every tarball HTTP 200 as a "download," the tool pushed the package to 2,581/mo (edging out pi-interactive-shell at 2,262/mo, a package that actually went viral on Twitter). The same pattern exists on pi-super-curl, the attacker's other package.
The current page defaults to "Most downloads" sort, giving the attacker the #1 slot. The root issue: npm downloads are a fundamentally unreliable signal. Any client-side slicing of npm download data (latest-version-only, anomaly detection, etc.) can be adapted around once the attacker reads the defense.