The PSF and several other organizations that provide public package registries wrote an open letter [1] announcing a joint effort to make this situation more sustainable. I'll be interested to see where it goes.

[1]: https://openssf.org/blog/2025/09/23/open-infrastructure-is-n...