Don't those package registries all suffer from not having namespaces? RubyGems in particular [1].
[1] https://thehackernews.com/2020/04/rubygem-typosquatting-malw...
People can just have maliciously typeo-d namespaces
Actually you could argue it's worse since people tend to pay more attention to package names rather then namespace names
However, typosquatting is an orthogonal problem to namespacing, you can still typosquat a namespace.
This is not the first time typosquatting attacks of this kind have been uncovered.
Popular repository platforms such as Python Package Index (PyPi) and GitHub-owned Node.js package manager npm have emerged as effective attack vectors to distribute malware.
"Orthogonal" suggests no connection but what I see above is a list of package managers that don't have namespacing.
I stated my reasoning in my comment: you can typo squat a namespace, just as easily you can any identifier. I don't see any inherent difference between the two.
correlation does not equal causation.
how is it not apparent that typosquatting is possible regardless of whether namespacing is in play?
for example, URLs are namespaced, and are the classic example of typosquatting: https://en.wikipedia.org/wiki/Typosquatting