Package manager should exist on Nostr instead. IDs are no loner needed because notes are signed. The open question still is where to host the heavier data.
PyPI was subpoenaed


PyPI was subpoenaed - The Python Package Index Blog
The PSF received three subpoenas from the US Department of Justice for PyPI user data in March and April of 2023.