Primarily companies at this point, with some ongoing input from individual contributors or universities / research organisations. I'm at Igalia (an open source software consultancy), so contributions from me and my colleagues are paid for by companies within the ecosystem. Vendors like SiFive and Rivos have particularly active contributors on the RISC-V backend, but there's many more.
From organisations, I understand LowRISC to be involved https://github.com/lowrisc. I'd also presume Espressif, as they have a growing number of risc32 chips.
I was previously at lowRISC but yes, they're still involved. My ex-colleague Luís Marques authored the patch I mentioned in the article to optimise global address accesses in the medany code model for instance.