Nobody pays for open source — a former npm lead says the registries should

Laurie Voss, an npm co-founder who ran the package registry for five years, has published a long essay arguing that thirty years of open source funding efforts have aimed at the wrong target. Companies already pay for open source, he writes — just not to the people who write it.

Free wins the code game

Voss borrows the hawk-and-dove model from evolutionary biology: closed source is the hawk, withholding code and charging a premium for it, while open source is the dove, giving code away and gaining from everyone else doing the same. The stable outcome, he argues, is “anybody may use this for anything, including commercially, for free” — MIT, BSD, Apache. Every project that tried to be a slightly less generous dove lost: React’s BSD+Patents licence reverted to MIT in 2017, and Elastic, HashiCorp and Redis all ended up with Linux Foundation forks — OpenSearch, OpenTofu, Valkey — before reversing course, with Redis restoring the AGPL in May 2025.

That equilibrium runs on burnout. Tidelift’s 2024 survey found 60% of maintainers are unpaid, the same figure as 2023 and 2021, and nearly 60% have considered quitting. The Linux Foundation’s Census II found 136 developers wrote more than 80% of the code in the fifty most-used packages, and a Harvard study put the cost of replacing open source at $8.8 trillion.

Companies pay — but not to maintainers

The money already moves, one layer up. JFrog, which sells a private mirror in front of public registries, reported $532 million in revenue in 2025, up 24%; Snyk is at about $326 million a year and Docker at $207 million. Sonatype runs Maven Central and sells the mirror in front of it, and says 86% of that registry’s traffic comes from cloud providers. GitHub Sponsors, by comparison, has paid out $100 million in total since launch.

Charge for supply, pay the dependency tree

The proposal has three parts. Registries meter corporate use and charge for it, while individuals, small teams, students and open source projects pay nothing. A fixed slice of that revenue is a royalty, paid pro rata and automatically every month to every package in a paying customer’s dependency tree, with no application form and no grants committee. The collectors are the dozen or so registries that own the domains. Some customers will move to a free mirror, as they could have with Docker, which lost some pulls and multiplied its revenue; fraud is the Spotify problem, so payment is weighted by presence in paying customers’ trees.

AI makes it urgent

AI agents are now the fastest-growing consumers of open source, and they consume it through registries. In May 2026 a swarm of agents run by OpenAI published more than 2,000 packages to RubyGems in two days and forced volunteers to suspend new registrations for four days. Daniel Stenberg shut down curl’s bug bounty after AI-generated reports pushed the share of real bugs from 15% to under 5%.

“The people who run the meter pay the people who make the thing worth metering,” Voss writes — an instruction to the dozen registries that supply open source rather than another appeal to the companies that consume it.