The typo-squatting aspect (and the the related recommendation to vendors) seems somewhat beside the point. I think the problem is simply: how can you tell that

The typo-squatting aspect (and the the related recommendation to vendors) seems somewhat beside the point. I think the problem is simply: how can you tell that a package is trustworthy? The article's scenario, where the victim relies on Stackoverflow answers to judge trustworthiness, would play out the same way without typo-squatting - for example, the Python 3 replacement for PIL is called Pillow. I'm pretty sure Pillow is legitimate, but how do I determine this is general?