PyPI uses hCaptcha, which pioneered real-time adaptation to this kind of abuse. No single measure can entirely halt abuse, but CAPTCHAs are a powerful tool to increase the cost of attacks. We offer service grants to key open source projects, in case other package hosts find this thread.
