This makes me wonder... it's entirely possible that the PyPI people would be enthusiastic about helping to track down offenders, and their users might agree, _if they knew what the offense was_. Instead, they're presented with a typically antagonistic demand for details, so they understandably get defensive on behalf of their users. I wonder if there's not a better, less heavy-handed way to get cooperation with law enforcement when the request is reasonable.

I wish it was that but those people would be smart enough to not use their real name when signing up - those doing supply chain attacks are often at least somewhat professional and take precautions.

I suspect it was more about going after software that was enabling piracy, those are often created by naive students who are not expecting the power of government to be unleashed on them.

Subpoenas are from March and April, predating the spamming of the past few weeks.