I think there were two problems here. 1. You hit a nerve with the distribution method. Everybody knows that npm is a ticking time bomb for malware delivery. De

I think there were two problems here. 1. You hit a nerve with the distribution method. Everybody knows that npm is a ticking time bomb for malware delivery. Developers already tend to react poorly when weird things happen to their build system, and the paranoia around npm made them react explosively. 2. I think targeting developers is probably the wrong approach. If you're serious about tackling this problem, you should find a way target executives, marketing, or developer relations people at companies that use the open-source packages in question, and give them ways to support the project in an official capacity. For example, give projects a standard way to offer 1-3 top-tier sponsorship spots, and 5-10 second-tier spots. Create an easy way for companies to bid for these spots across a handful of open-source projects that they use and like. The companies that pay $10-20k for a booth at the Open Source Summit conference will absolutely eat this up.