Hacker News Reader

in general npm does a not-too-great job with these things

Remember, NPM stands for Now Part of Microsoft!

(Microsoft owns GitHub, which owns NPM.)

Which means they don't have the excuse of being a volunteer effort to not be on top of this. MS has plenty of resources.

If you're running this kind of infrastructure online these days, you have every right to require payment somehow. Don't work for free.