While the Java ecosystem tends to get a lot of criticism, this is one thing they got right: fetching a package name from a public repository involves prefixing the name with the reverse-DNS name of the uploader (the "group ID" in Java/maven parlance). Uploaders can only submit packages after they've proven they have control over the domain.
It's really unfortunate that even newer package management ecosystems like Rust's haven't learned that lesson. Yes, it increases initial setup friction, but dependency confusion and name squatting issues more or less just go away when you do that. Sure, you might run into issues where people register domains for common misspellings of popular domain names, but that's already a problem with website resolution, and there are ways to mitigate that.
It's really unfortunate that even newer package management ecosystems like Rust's haven't learned that lesson. Yes, it increases initial setup friction, but dependency confusion and name squatting issues more or less just go away when you do that. Sure, you might run into issues where people register domains for common misspellings of popular domain names, but that's already a problem with website resolution, and there are ways to mitigate that.