OpenSSF and Tech Giants Call for Sustainable Funding to Secure Global Software Supply Chain

The OpenSSF (Open Source Security Foundation) Governing Board has issued an urgent call for a fundamental shift in how the world’s most critical software infrastructure is funded. In a move that highlights the growing fragility of the modern digital economy, the board is urging enterprises that rely heavily on public package registries to provide more robust and predictable financial support, warning that the current model—largely dependent on volunteer labor and donated resources—is no longer sustainable in the face of escalating threats and unprecedented demand.

The call to action was formalized through a pledge signed by several of the most influential names in the technology sector, including GitHub, Google, IBM, Microsoft, and Sonatype. These organizations, which both contribute to and consume vast amounts of open-source software, have acknowledged that the infrastructure underpinning the global software supply chain is under immense pressure. The pledge outlines a stark reality: public package registries are facing a dual crisis of rising operational costs and an urgent need for massive investment to bolster security and improve the developer experience.

Public package registries such as npm, PyPI, Maven Central, crates.io, RubyGems, and NuGet serve as the central nervous system for modern software development. They are the repositories from which developers pull the pre-written code modules and libraries that make up the vast majority of modern applications. However, despite their critical role, many of these registries have historically operated on a "best-effort" basis, often managed by small, dedicated teams and funded through the goodwill of corporate donors or parent organizations.

According to the OpenSSF and its signatories, this "survival mode" of operation is no longer compatible with the needs of a global economy that depends on these systems for security, reliability, and compliance. The firms noted that every organization building software today depends on these registries, yet the demands being placed on them—ranging from high availability to advanced threat detection—are growing faster than the resources available to meet them.

The Mounting Pressure of Trillions of Downloads

The scale of the challenge is reflected in the sheer volume of traffic these registries now handle. Public repositories currently serve trillions of downloads annually, with growth rates remaining consistently high at between 30% and 50% year-over-year. This exponential increase in demand places a heavy burden on the physical and cloud infrastructure required to host, mirror, and distribute packages globally.

As download volumes soar, the operational complexity of maintaining these systems increases. Registries must ensure that packages are available 24/7, that download speeds remain consistent across different geographic regions, and that the integrity of the code being distributed is never compromised. In the current landscape, many registries still rely on a patchwork of donated infrastructure credits from cloud providers and are managed by teams that sometimes consist of as few as two or three people. The OpenSSF warns that this lean staffing and reliance on charity make the registries vulnerable to outages, slower responses to emerging threats, and a general lack of visibility across the supply chain.

The financial pressure is not merely about keeping the lights on; it is about keeping the gates shut against increasingly sophisticated adversaries. The software supply chain has become a primary target for cybercriminals and state-sponsored actors who seek to inject malicious code into widely used libraries. The OpenSSF reported that in the current year alone, 1.8 million malicious packages have been discovered across various registries.