18 popular packages with a total of 2 billion weekly downloads were targeted in an attack.