This looks like someone trying to replicate Alex Birsan's attack on Apple, Microsoft, and others but through package confusion instead of version squatting. Reasonable speculation:
1. Host thousands of typo packages that phone home every time they are installed. Store IPs.
2. Find which companies own those IPs, filter out residential
3. Report vulnerabilities