What prevents abuse? Maintainers of npmx are changing the data of their other projects, don't you see how this smells bad?
Even if all is correct, relying on self-reporting means the incorrect data on other projects makes those look bad by comparison.