How would any normal person know that npmjs.help is phising, but npmjs.com is valid?
> But beyond the technical aspects, there's something more critical: trust and long-term maintenance. I have been active in open source for over a decade, and I'm committed to keeping Chalk maintained. Smaller packages might seem appealing now, but there's no guarantee they will be around for the long term, or that they won't become malicious over time.
I expect him to know better.
Shouldn’t this be solved some other ways?
This is also easily avaidable by using password manager which will not autofill credentials on a page with a wrong domain.
Edit: And yes, I do this for every link emailed to me that does anythig more high stakes than point me to a newsletter article.
You still don't know then of course. When in doubt you shouldn't do the action that is asked through clicking on links in the mail. Instead go to the domain you know to be legit and execute the action there.
Having said all that, even the most aware people are only human. So it is always possible to overlook a detail like that.
The whole web is a darn mess! I have no ideas for solutions.