package-registries

A new Linux Foundation working group--backed by Sonatype, the Rust Foundation, OpenSSF, and a dozen registry operators--aims to close the funding and governance gap before AI-driven download volumes overwhelm critical open source infrastructure.

An audit of the world's largest open source package registries finds they spend 12 percent of their budgets fighting malware and just 2 percent on new features, with no path to sustainable security funding.