Hacker News Reader

Is the solution to this problem Golang style package management where you specify the git repo?

probably no:

that malware campaign is still active.

Any string can be typosquatted unfortunately.

Even worse, LLM hallucinations can be squatted to the same effect.