On: Malicious crossenv package on npm

[krapp]

Is there likely to be a good reason for one package name to be two or three character transforms away from another?

Maybe have all packages be scoped under a namespace, and then globally require a minimal uniqueness for the package name itself.