> I think about this every time I install something through pip or apt. [...] it seems like a simple task to just register common typos and spread malicious cod

> I think about this every time I install something through pip or apt. [...] it seems like a simple task to just register common typos and spread malicious code. I assume there's some kind of vetting? For distribution repositories (apt and so on), yes there's some vetting. To start with, only a limited set of people (the distribution's developers) are allowed to upload packages to a distribution repository, and even then, there's often a second layer of vetting for new package names. For instance, on Debian (https://wiki.debian.org/Teams/FTPMaster https://wiki.debian.org/Teams/FTPMaster): "When a package is uploaded to the unstable or experimental suite, it falls into one of three categories. If it is a new version of an existing package and adds no new binary packages, it is moved into the package pool automatically. If one or more of the binary packages or the source package itself is not currently in the archive or if a package is moved between the components (main, contrib, non-free), it is NEW and must be examined by an FTP Team member (see NewQueue). [...]" That is, when a new binary package is added, either because it comes from a new source package, or because a source package was modified to add a new binary package, the FTP masters have to manually approve it, before it becomes available to be installed by apt. This is different from language repositories (pip and so on), in which anyone can register a developer account, and there's no manual vetting of new package names.