> But in the general case, it's a hard, never-ending cat-and-mouse game

One point of view is that in the general case this problem is solvable, has been solved, and the solution isn't well known.

> How do they mitigate that kind of activity without logging basic metadata like the IP address that published a package

An effective mitigation for abuse/spam is to increase its cost. One example is to require payment.

That's also a highly effective mitigation against legitimate users, especially those already disadvantaged everywhere else by a lack of disposable income.

How did you conclude payment equals parting with the money and not getting it back? Collateral works well for many problems in the world.

It would not go over well if PyPI started charging people to host packages.

Charging goes well for many online services. Hosted email, hosted VPS, and hosted SaaS are some that come to mind. Apple Store and Google Play charge to host mobile games.

And the feds can subpoena all those services and their payment providers for logs including IP address that made the transaction.

Notably, none of your examples include the central distribution service which underpins a whole FOSS ecosystem.

Now they need to subpoena both PyPI and the payment processor. It does slow them down but effectively does nothing to "thwart future subpoenas from the total surveillance state".

Linux Core Kernel Commentary: Guide to Insider's Knowledge on the Core Kernel of the Linux Code

https://www.amazon.com/Linux-Core-Kernel-Commentary-Knowledg...

Understanding the Linux Kernel, Third Edition 3rd Edition

https://www.amazon.com/Understanding-Linux-Kernel-Third-Dani...