Also devs should get into the habit of providing sha256 hashes on offical channels (i.e., github readme) so users can validate (if its possible to validate a pkg before executing malicious code in the python ecosystem, I'm not sure how that'd work).
If we are talking typos or other human errors, guess we could only warn people that there are other package with similar name available. Can't predict what people have in mind when they make a typo.
[1] https://www.cisa.gov/uscert/ncas/current-activity/2021/10/22...
I would think the easy solution is to publish a public signing key per-person or per-project, and then sign individual files with that. So, GPG.
This is an excellent idea. Authors are something we are digging into heavily as part of an ongoing effort to improve trust in the open source ecosystem.