I’d be curious to hear what you think that PyPI et al are doing that NPM should be copying. It sounds like you’re pretty knowledgeable in this area, to be comfortable making comments like this with such confidence.