Clarify meaning of empty version list

[funnelfiasco]

This came up in guacsec/guac#2366. This repo is not clear on the meaning of an empty version list. My colleague interpreted it as "there are no known malicious versions of this package." I understand it to mean "all versions are known malicious," for example the Python aiohtttps package, which is a typosquat. An explicit explanation would help consumers of this repo.

[ikretz]

Hi @funnelfiasco, thank you for raising this issue.

These cases come from the earliest days of the project when version info wasn't attached to the sample names. Around 250 PyPI packages are affected. In these cases, your interpretation is correct: all versions should be considered malicious.

I have clarified this in the README in the linked PR.