This is the form for reporting malware on Play, and it includes a free-form text input for describing the issue:

https://developers.google.com/android/play-protect/pha-repor...

(It is a bit odd that there's no DoS category on the report form, despite it being listed as a category on their taxonomy page at https://developers.google.com/android/play-protect/phacatego..., but I expect that you can just enter that in the "other" free text field.)

The fact that this thing has 5 million installs is disturbing. You generally assume that the large install count apps have been vetted. Or at least that this kind of thing like in the article has surfaced way before millions of installs and the app was taken down.