A Research Lab for Open Source

Today, we're launching a world-class research lab dedicated to Open Source sustainability with a team of some of the most experienced people in the world.

Why? The infrastructure we all use depends on Open Source: transportation, healthcare, the internet and more. When the Open Source packages we use break, our infrastructure is at risk.

This isn't just hypothetical. It's happening already, with catastrophic global supply chain attacks such as the XZ Utils backdoor, Log4Shell, Shai-Hulud and others.

There are efforts underway to make Open Source development more sustainable. The Open Source Pledge has raised $7,262,189 for maintainers, the Open Source Endowment is nearing a principal of $1m, and excellent research is being done by the Sovereign Tech Agency, Alpha-Omega and others.

But we need an organisation dedicated to answering the more general questions that Open Source sustainability depends on. What are the most critical keystone packages? Which keystone packages appear to be maintained, but are actually long-dead Bernies? Which dependencies are invisible to us? How can we prevent the ever-growing issue of maintainer burnout?

One would think that one of the many well-funded Open Source foundations could tackle this research, with a median yearly revenue of $1.6m and a mean of $11.6m. But for the most part, foundations, as a policy, do not pay developers at all, so they cannot fund this work. This is partly a quirk of the US tax code — until the Feb 2026 launch of the Open Source Endowment, the IRS had not recognised Open Source software as serving the public benefit, so they had not given 501(c)(3) status to any organisation that funds Open Source development.

What about for-profit companies? Some, like Chainguard and Socket are building software supply chain analysis tools. But this work is proprietary, which doesn't sit right with our vision. The tools that allow us to monitor our critical infrastructure are themselves critical infrastructure, so they should be publicly accessible, and funded independently of for-profit interests.

That's why we founded the Software Stewardship Lab: a new non-profit research lab dedicated to ensuring the stability of the Open Source ecosystem we all depend on.

We map and strengthen the Open Source ecosystem by building software, creating APIs, and writing research reports. And our research takes into account the human side of Open Source, by investigating and caring for maintainer health.

Our team includes some of the most experienced people in the field:

• Vlad-Stefan Harbuz, director of the Open Source Pledge and adviser to the Open Source Endowment.
• Andrew Nesbitt, creator of ecosyste.ms and probably the world's foremost expert on package management.
• Miranda Heath, author of the to-date most comprehensive report on burnout in Open Source.
• Dawn Foster, CHAOSS board member, with a PhD using metrics to study the Linux kernel.
• Daniel Roe, leader of globally-used web framework Nuxt and a steward of npmx.
• Matias Capeletto (patak), also a steward of npmx, and a legendary Open Source community leader.
• Mike McQuaid, leader of Homebrew and a former GitHub Principal Engineer.

We are registered as a Scottish non-profit — though our scope is global — and our values and articles legally bind us to serving the public good and making all our work publicly accessible. Our independent non-executive directors hold us accountable.

“If we don't secure the software supply chain, the vast majority of software will suffer.  The Software Stewardship Lab has a collection of world-class experts in addressing problems like this and represents perhaps the most ambitious effort today to solve the key problems in a fundamental manner.”

Our current research focuses are:

• Software supply chain security — We're working on an observatory that allows users to identify and monitor the world's critical Open Source packages in real time, including previously hidden parts of the dependency graph. More details here.
• Maintainer burnout — Our report on burnout in Open Source has been well-received. We're working on yearly follow-ups, plus a companion report on how AI is affecting maintainer burnout.

Moving forward, the Lab's experts will direct funding to and supervise Open Source sustainability researchers doing critical work. We are already working with universities to teach the next generations of software supply chain experts.

And we are also working with our solicitors on achieving charity status. Charity regulators have not historically recognised Open Source software as a charitable purpose. We hope that by seeking charity status, we will help pave the way for charity regulators worldwide to recognise the criticality of Open Source infrastructure.

“This effort is critical to the future sustainability of Open Source. The unique challenges the Open Source ecosystem is facing need the sort of Open Source thinking the Software Stewardship Lab is building. Open Source has never been more important. It's imperative we give it a strong future.”

But we need your help.

We can't do this research without funding. In fact, without funding, we would be in the ironic situation where we couldn't sustainably develop the very technology required for the Open Source ecosystem to be more sustainable. That's a Catch-22 with serious ramifications.

We have seen that companies are willing to fund keystone Open Source projects, which is important.

But we're asking organisations to also fund Open Source sustainability research, simply because it acts as a force multiplier — it creates tools that strengthen the entire ecosystem, not just individual projects. Each dollar funds structural improvements to the foundations of our technological infrastructure.

We have various sponsorship arrangements available:

• For companies, multiple sponsorship tiers with various benefits.
• For grant-making organisations, a grant proposal on Securing Python's Binary Dependencies, and others in the works.
• For individual donors, more information on our Sponsor page.

All our income and expenses will be detailed on Open Collective with full transparency.

Know that, if you are able to help fund our work, you are making a positive difference to the Open Source ecosystem that the entire world relies on.

Open Source lies at the foundation of our modern technology. That technology can, and does, fall apart when keystone projects are underfunded and insecure, and when maintainers are overworked. Existing solutions aren't doing enough to preserve our critical infrastructure.

We can solve this problem together with your support. If you're able to, sponsor us.

Vlad-Stefan Harbuz, Executive Director

Together with our board:

Andrew Nesbitt
Miranda Heath
Daniel Roe
Dawn Foster
Matias Capeletto