Do we really need hard proof of real downloads for an example like this? Typosquatting is obviously a scary problem regardless, with a history of successful exploitation in web domains, other package managers, etc.