That's interesting. There is a policy and process (PEP 541) in place for addressing this, and it seems to have been executed swiftly and responsibly. Is this incident an argument for namespacing, or that the status quo is good enough?

I feel like domain name disputes tilt disproportionately to trademark holders, so I wouldn't like to see, e.g., cupy block a cupyd package or vice versa (or, for that matter, NVIDIA somehow strongarm cupy). On the other hand, you'd like a mechanism by which you can trust that a package comes from the cupy maintainers.