I remember some years ago when npm was having a lot of stability issues because the guy just was not being given adequate time/resources from Joyent or whatever, I made a post on r/node saying now was the time for a fully decentralized package registry.

The post if I remember was mostly ignored, but received a few downvotes and maybe a couple of negative comments.

Based on that, it seems that what's preventing decentralization from taking off is ignorance and apathy.

A day or two later the guy announced npm, Inc. if I remember.

There are actually a lot more developers that have accepted a federated services worldview than a peer-based fully distributed one. But there are package registry projects along both of those lines.

https://github.com/orbs-network/decentralized-npm

https://blog.aragon.one/using-apm-to-replace-npm-and-other-c...

https://github.com/entropic-dev/entyropic

https://github.com/axic/mango

But again, ignorance, apathy, and the status quo remain the most popular options.