Why wait? You can already try and publish malware to package registries using misspellings of names of popular packages. Of course in practice, the maintainers

Why wait? You can already try and publish malware to package registries using misspellings of names of popular packages. Of course in practice, the maintainers of the registries have a vested interest in preventing this kind of behavior and probably have multiple approaches to detecting if people are doing stuff like this.