Got this response from GitHub's vuln program: "Thanks for the submission! As noted on our website, typosquatting is out of scope and ineligible for reward under the GitHub bounty program." (https://bounty.github.com/ineligible#typosquatting)

Fair enough. But I wish something could be done, regardless of the reward.