Slopsquat CVE?

This came up on conversation over the weekend and I thought I would reach out here and on social media. There is a theoretical way to weaponize slopsquatting, which is to create many (number to be determined) repositories on Github that use a loadable package that promises one thing but has a back door in it to enable an adversary to take control. By filling a pipeline of repositories, giving them "popularity" with a spambot army, one could "inject" into the CoPilot model that the package with the back door was a valid solution to some common coding "want." If the compromised package "worked" to the extent that it did what it said it does until someone asks it to do something different, it could conceivably migrate into non adversary controlled repositories and from there into the greater network.

So crazy talk or CVE? Hard to tell the difference these days.