PyPi and NPM, also mentioned in the article, are not, on the face of it, collections of random uploads. They present themselves as resources for developers in their respective languages. A user might reasonably expect them to be sources of high quality S/W. AFAICS the reality is that both collections simply accept contributions on trust with mechanisms to remove malware once the damage has been done.
Should you have the misfortune to fall victim to one of these, possibly as a result of a library downloaded by someone else acting in good faith, you might have occasion to reflect that there are worse problems than spelling variations although these are, in fact, at the very heart of typosquatting. You might even come to the conclusion that uploads should be vetted before being publicly posted. You might even use the term "curated".
PyPi's "terms of use" make no mention of not uploading malware: they're entirely concerned with an uploader having the rights to distribute the material. They make no mention of the terms on which material is provided to the downloader. Neither is there any mention in the code of conduct.
NPM is slightly better. The acceptable content, in its 3rd paragraph forbids malicious content. Perhaps reasonably this positions it after licencing considerations but both are placed after "harassing, inappropriate, or abusive".