OpenSSF and Tech Giants Call for Sustainable Funding to Secure Global Software Supply Chain

Furthermore, the advent of artificial intelligence is expected to exacerbate these security challenges. The foundation anticipates that AI-driven tools will lead to a three-to-fivefold increase in "publish events," as automated systems generate and push more package versions and updates to public registries. While some of this activity will be legitimate, the sheer volume will make it harder for human moderators and traditional security tools to distinguish between helpful updates and automated attacks.

Moving Beyond Survival Mode

The core of the OpenSSF’s argument is that sustainable funding would allow registries to move beyond basic maintenance and toward a more proactive, enterprise-grade service model. With predictable and recurring revenue streams, registries could implement the advanced features that modern enterprises now demand but are currently unable to receive from free public services.

Among the proposed improvements are the implementation of dedicated support channels for high-volume users and the creation of private or peered access points. Such optimizations would allow large-scale consumers to pull packages more efficiently, reducing latency and improving the reliability of their internal build pipelines. Additionally, funding would enable registries to offer more sophisticated monitoring, alerting, and operational support, significantly minimizing the risk of downtime that can stall development for thousands of companies simultaneously.

From a security perspective, the benefits of a sustainable funding model are even more pronounced. The OpenSSF envisions a future where registries can offer comprehensive security features as a standard part of their operation. This includes artifact signing and trusted publishing mechanisms to verify the identity of package authors, as well as automated malware scanning and quarantine procedures to catch malicious code before it is downloaded by millions of users.

Furthermore, registries could provide critical data for compliance and auditing, such as the generation of Software Bills of Materials (SBOMs) and Vulnerability Exploitability eXchange (VEX) documents. These tools are becoming essential for organizations as they navigate new regulatory requirements and internal security policies. Without a more robust funding model, the registries will struggle to provide the build provenance attestations and incident response Service Level Agreements (SLAs) that are now considered table stakes in the enterprise world.

A New Model for Enterprise Consumers