But who will detect them on day one once everyone ignores them for seven days?

These things are usually caught by tools specifically scanning npm or by the maintainers noticing their account is compromised, not by people auditing their own installed packages.

There are some companies that specialize in detecting those, they do it for free (and get lots of marketing for it…)

AI agents