We certainly are grateful to Nat Friedman for stepping in and fixing this. We have been aware of the centralization issue generally, and in fact just this week

We certainly are grateful to Nat Friedman for stepping in and fixing this. We have been aware of the centralization issue generally, and in fact just this weekend, we released Julia 1.4, which has redesigned the internals of the package manager such packages can be served from our own infrastructure. There's already a plan for migration away from Github as the source that serves packages. For Julia 1.4 it needs to be turned on by the user, but going forward, the new infrastructure is likely to be the default. We imagined many reasons for needing to do this to safeguard the long term stability of the Julia ecosystem. For example, an author may delete a key package they own, accidentally or for their own reasons (like the lpad case in javascript), or as we learnt in this case, packages can get accidentally flagged and break things. Thankfully the Pkg team has been one step ahead on this.