Thanks, I came here to post this exact thing.

Even if NPM isn't prohibiting packages, you'd imagine they'd have internal security alerting for Levenshtein distance from the names of very popular npm packages. Such an alerting script wouldn't take terribly long to write (or to run). It'd let them catch this type of abuse much faster even if they decided (for some inane reason) that banning the names outright would break UX.

You can't assume that the original developer will be the first person to post their package. For example, I published some code on my blog long before NPM was a thing. Today that code gets 10k downloads a month on NPM but I had nothing to do w/ publishing it on NPM and haven't audited it for changes.

Not really different from any other typo-squatting (e.g. domains).

Except that in this case you're installing software on your computer, not just visiting a webpage.

You might also be downloading the software from a webpage. ;)

That would still be a two-step process (downloading from the browser and then manually executing it).

`npm install` runs code as part of the initial step.

Also, `npm install foo` will of course not just run code from `foo` but from all its dependencies and their dependencies dependencies as well.

Typosquatting can be prevented by premoderation in the repository.