ginto

Charging goes well for many online services. Hosted email, hosted VPS, and hosted SaaS are some that come to mind. Apple Store and Google Play charge to host mobile games.

How did you conclude payment equals parting with the money and not getting it back? Collateral works well for many problems in the world.

But in the general case, it's a hard, never-ending cat-and-mouse game

One point of view is that in the general case this problem is solvable, has been solved, and the solution isn't well known.

How do they mitigate that kind of activity without logging basic metadata like the IP address that published a package

An effective mitigation for abuse/spam is to increase its cost. One example is to require payment.

Linux Core Kernel Commentary: Guide to Insider's Knowledge on the Core Kernel of the Linux Code

https://www.amazon.com/Linux-Core-Kernel-Commentary-Knowledg...

Understanding the Linux Kernel, Third Edition 3rd Edition

https://www.amazon.com/Understanding-Linux-Kernel-Third-Dani...