No. Maintainers should be able to publish whatever they want. Users should save whatever they want to consume locally for whatever specification of local (disk,

No. Maintainers should be able to publish whatever they want. Users should save whatever they want to consume locally for whatever specification of local (disk, mirror, whatever) works for them. Malicious actions will be rejected and punished by the marketplace. If GitHub et al want to be a value of local, i.e. controlled by the (community of) users then they can play that role, but no one should expect them to