That's still a lot harder and more visible than just taking over an orphaned package or many of the other attacks we see in these other ecosystems. Especially

That's still a lot harder and more visible than just taking over an orphaned package or many of the other attacks we see in these other ecosystems. Especially since DNS gives you real visibility into ownership when auditing/selecting packages. org.apache is a lot more trustworthy than tk.helicopter.