@pluralistic Wow, this is bad.

"Our findings revealed that several large companies either use or recommend this package in their repositories. For instance, instructions for installing this package can be found in the README of a repository dedicated to research conducted by Alibaba"

Recommend the dummy package? Like WTF.
Check your dependencies FFS.