Are Package Registries Holding Open-Source Hostage?