Loading story…
Major open-source software (OSS) foundations and public code repository stewards have issued a joint statement urging commercial software companies to provide sustainable financial support for the platforms they rely on. The statement highlights the critical role that OSS platforms play in the global software supply chain, with public code registries now handling trillions of downloads each month, much of it driven by automated commercial processes such as continuous integration pipelines and dependency scanners. The stewards, representing organizations including Alpha-Omega, the Eclipse Foundation, the OpenJS Foundation, OpenSSF, Packagist, the Python Software Foundation, the Rust Foundation, and Sonatype, warn that the current model—where large commercial users extract significant value without proportional financial contribution—threatens the long-term viability of these registries. They argue that open-source infrastructure cannot be expected to operate indefinitely on the basis of unbalanced generosity and informal, inconsistent support. The call to action comes in the wake of a series of high-profile attacks targeting OSS infrastructure, underscoring the urgent need for robust funding to enhance software supply chain security. The joint statement emphasizes that sustainable funding models must scale with usage, ensuring that the largest beneficiaries of OSS platforms contribute to their maintenance and security. The stewards point out that the explosion in OSS usage has not been matched by a corresponding increase in financial support, creating a risk of crisis for the ecosystem. They stress that the security of the global software supply chain is directly tied to the health and sustainability of OSS infrastructure. The statement also notes that commercial and proprietary software publishers often use public registries as free content distribution networks, further increasing the operational burden on these platforms. The foundations call for a shift in mindset among commercial users, urging them to recognize their responsibility in supporting the infrastructure that underpins their products and services. They highlight the need for new funding mechanisms that are predictable, scalable, and aligned with the level of usage. The statement concludes by warning that without committed financial support from the ecosystem’s largest users, the OSS ecosystem faces a growing risk of instability and security vulnerabilities. The call for action is seen as a pivotal moment for the future of open-source software and the security of the broader technology landscape. Industry observers note that this appeal may prompt a reevaluation of how commercial entities engage with and support the OSS community. The move is widely regarded as essential to ensuring the continued innovation, reliability, and security of open-source platforms that are foundational to modern software development.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Open-source package registries that underpin software supply-chain security—**PyPI**, **npm**, **Crates.io**, **RubyGems**, and **Maven Central**—are facing a growing financial crisis that threatens their ability to operate securely. **Michael Winser**, co-founder of the Linux Foundation’s **Alpha-Omega** initiative, warned that registry usage is growing exponentially while investment in infrastructure and staffing remains flat, leaving these services “living on borrowed time.” Key cost drivers cited include bandwidth, storage, compute, and the expanding effort required to detect and remove malicious packages, with AI contributing to increased volume and velocity of submissions. Both reports emphasize that current funding models (grants, donations, and in-kind support) are not keeping pace with operational and security needs, creating risk that registries will be unable to implement or sustain critical protections such as malware detection and package integrity controls—undermining “trusted source” assumptions central to **SBOM-driven** supply-chain programs. Winser argued that enterprises should normalize paying for registry services as an operational expense rather than treating support as optional charity; without more sustainable funding, the time-to-remediate malicious packages (reported as a median of **~39 hours** in one account) and the overall exposure to supply-chain compromise are likely to worsen.
Jun 29, 2026
Open-source software forms the backbone of much of today's digital infrastructure, powering browsers, applications, and critical business systems. Security leaders are increasingly aware of the risks associated with integrating open-source components into their environments, as vulnerabilities can be present even in widely used and actively maintained projects. A recent study by James Cusick at Ritsumeikan University compared the security of open-source and proprietary software by scanning millions of lines of code. The analysis revealed that large open-source projects like Chromium, despite their robust contributor communities, still contained over 1,400 potential issues, though only a few were deemed critical or high severity. In contrast, smaller open-source projects such as Genann exhibited a much higher density of potential issues, with one problem for every 27 lines of code. Proprietary software, while not immune, generally fell between these extremes, with most issues rated as medium or low severity. These findings highlight the importance of static code scanning and rigorous review processes for all software, regardless of its origin. The integration of open-source components without thorough vetting can introduce significant supply chain risks, as vulnerabilities may remain undetected and exploitable. In response to these challenges, regulatory frameworks like the European Union's Cyber Resilience Act (CRA) have been developed to enhance software security and transparency. According to Greg Kroah-Hartman, a leading Linux kernel maintainer and member of the CRA working group, the Act has evolved to be more accommodating to open-source developers. The CRA now requires producers of products with digital elements to document, secure, and maintain their software supply chains, including the generation of Software Bills of Materials (SBOMs) and proactive vulnerability management. While initial drafts of the CRA raised concerns among open-source communities about potential legal liabilities, subsequent revisions have made the regulations more palatable and beneficial for open-source contributors. Organizations like the Linux Foundation and Mozilla are required to comply with these rules, but individual contributors are generally exempt unless they are acting as commercial entities. The CRA aims to foster greater transparency and accountability in software development, ultimately benefiting both open-source and proprietary ecosystems. Security leaders are encouraged to adopt comprehensive code scanning and supply chain management practices to mitigate the risks associated with open-source software. The evolving regulatory landscape underscores the need for organizations to stay informed and proactive in addressing software security challenges. By combining technical diligence with compliance efforts, businesses can better protect themselves against the hidden risks inherent in modern software supply chains. The ongoing dialogue between regulators, open-source communities, and industry stakeholders is shaping a more resilient and secure digital environment for all.
Jun 29, 2026
The Open Source Security Foundation and the OpenJS Foundation issued an alert warning that attackers are using social engineering to seize control of open-source projects by targeting maintainers and trusted contributors. The warning highlighted account takeovers, fraudulent outreach, and other tactics that can give adversaries the ability to publish malicious updates through legitimate projects, creating downstream risk for organizations that depend on widely used packages and developer tooling. OpenSSF later published guidance for maintainers on hardening CI/CD pipelines after the `tj-actions` and `reviewdog` supply-chain incidents, emphasizing stronger identity verification, tighter repository and workflow permissions, protection for release processes, and closer monitoring of automation used to build and distribute software. Together, the alerts describe a growing pattern in which attackers compromise trust in the open-source ecosystem and then abuse build and release infrastructure to propagate malicious code to users at scale.
Jul 12, 2026