> I don't think there are any maintainers that verify upstream code, they only manage packages and updates. Even that minimal amount of work is enough to preve

> I don't think there are any maintainers that verify upstream code, they only manage packages and updates. Even that minimal amount of work is enough to prevent such a ridiculous attack like typo squatting.