Sure, this will remove one problem: type/domain squatting. All the other ones remain. I can't wait for Stackoverflow spamming to get the scammers answer with

Sure, this will remove one problem: type/domain squatting. All the other ones remain. I can't wait for Stackoverflow spamming to get the scammers answer with a legit solution + url + hash at the top of Google search when typing the name of the package. Before that, you'd install from npm. But now, any URL is fair game. I'll get the pop corn.