You don't need a strict ban for this to work either. Maybe just an end-user warn...

andrewfong on Sept 15, 2017 | parent | context | favorite | on: Malicious software libraries found in PyPI posing ...

You don't need a strict ban for this to work either. Maybe just an end-user warning if distance < N and the relative popularity of the two modules is very high. You could also allow users or organizations to explicitly whitelist some names.