That might get PyPI into trouble especially with a gag order which we can assume that they are forced to obey and forced not to talk about.

PyPI would pretty much want to inform the users, but they probably simply can't (without getting into legal trouble).