As of this post, sec has it in a "hidden" file https://www.sec.gov/include/ticker.txt. They may remove but it has over 12K maps right now.
Why is cusip/ticker mapping such a big secret?
If you use sec data, they often provide cusips but no ticker. Also cusips reported are often inconsistent with "official" cusips for the ticker (like NPORT-P).
Can this be incorporated into yfinance?