Cybersecurity Policy Report, Cybersecurity Demands, Resource Limitations Seen Straining Open-Source Software Community, (Sep 23, 2025)
Organizations Mentioned:Sonatype, Inc.
New demands on developers and distributors of open-source software (OSS), including cybersecurity requirements, are straining the OSS community and exposing the need for a new model for “free” software, according to an open letter published today by eight OSS organizations.
“Over the past two decades, open source has revolutionized the way software is developed,” the groups said. “Every modern application, whether written in Java, JavaScript, Python, Rust, PHP, or beyond, depends on public package registries.”
“These registries have become foundational digital infrastructure—not just for open source, but for the global software supply chain,” including vendors of proprietary software, they noted.
“Beyond package registries, open source projects also rely on essential systems for building, testing, analyzing, deploying, and distributing software,” they said. “And yet, for all their importance, most of these systems operate under a dangerously fragile premise: They are often maintained, operated, and funded in ways that rely on goodwill, rather than mechanisms that align responsibility with usage.”
“Open source infrastructure cannot be expected to operate indefinitely on unbalanced generosity. The real challenge is creating sustainable funding models that scale with usage, rather than relying on informal and inconsistent support,” they added. “Billion-dollar ecosystems cannot stand on foundations built of goodwill and unpaid weekends.”
The groups noted that new obligations had been imposed on the OSS community in recent years, including the demand for “continuous monitoring, traceability, and auditability of systems” by governments and enterprises and new regulatory requirements, such as the European Union’s Cyber Resilience Act (CPR, April 18, 2023).
OSS infrastructure also “must be responsive to other types of attacks, such as spam and increased supply chain attacks involving malicious components that need to be removed,” they said.
They called for organizations that rely on OSS to, among other things, contribute to the OSS community with funding or volunteers and configure their software and systems so that they don’t overburden OSS repositories.
“We must shift from a culture of invisible dependence to one of balanced and aligned investments,” they added. “If we act now to evolve our models, creating room for participation, partnership, and shared responsibility, we can maintain the strength, stability, and accessibility of these systems for everyone.”
The letter was signed by Alpha-Omega, the Eclipse Foundation, the OpenJS Foundation, the Open Source Security Foundation, Packagist, the Python Software Foundation, the Rust Foundation, and Sonatype, Inc.
News: FederalLegislation DataSecurity