Open Source Crisis: 60% Unpaid, $20M Emergency Fund

Open source is collapsing under its own success. 60% of maintainers work unpaid while serving billions of commercial downloads monthly, infrastructure providers operate at deficits despite hosting the Linux Foundation and Apache, and HeroDevs just launched a $20 million emergency fund—the largest single sustainability initiative in open source history. Industry CEOs now openly predict 2025 as “the year open source ceases to gain traction as a business model,” as emergency interventions attempt to patch a systemic crisis decades in the making.

Every developer depends on open source daily. Every npm install, every PyPI package, every Maven dependency runs on volunteer-run, deficit-funded infrastructure reaching breaking point. The modern software economy is built on unpaid labor at commercial scale—and that model just failed.

The Numbers Don’t Add Up

Package registries serve “billions (perhaps even trillions) of downloads each month” driven by commercial usage, yet 60% of maintainers receive zero compensation and infrastructure operates on nonprofit budgets funded by a “small group of benefactors.” The Open Source Security Foundation’s joint statement—signed by 10 major foundations including PyPI, Maven Central, and crates.io—warns that “open infrastructure cannot be expected to operate indefinitely on unbalanced generosity.”

The mismatch is stark. Oregon State University’s Open Source Lab hosted the Linux Foundation, Apache, Drupal, and Firefox while delivering 430 terabytes monthly. For years, it operated at a deficit. Revenue model: 20% from hosting services, 80% from declining corporate donations. When the CS department could no longer cover the gap, the lab needed an emergency $250,000 to avoid shutdown.

This is the fundamental crisis: massive commercial benefit extraction with minimal proportional contribution. Companies use “public registries as free global CDNs,” in the OSSF’s words. Developers type npm install without realizing they’re consuming services that run on volunteer time and nonprofit budgets. When critical infrastructure nearly shuts down, the model isn’t sustainable—it’s already broken.

The $20 Million Band-Aid

HeroDevs launched a $20 million Open Source Sustainability Fund in June 2025, offering $2,500 to $250,000 grants to maintainers following end-of-life best practices. This emergency fund directly responds to alarming security data: 86% of codebases contain software with known vulnerabilities, and 48% of all enterprise vulnerabilities come from EOL software that maintainers can’t afford to support.

The company previously donated $4 million since 2021, including $2 million in 2024 alone. CEO Aaron Frost captured the impossible choice maintainers face: “Open source creators shouldn’t have to choose between their life and their legacy.”

However, the $20 million fund is both rescue mission and admission of failure. A company had to launch an emergency intervention because existing funding models collapsed. This proves three things: the crisis is real and urgent (companies are spending millions), existing models failed (emergency funds needed), and $20 million is still just a band-aid on a systemic problem. The fund helps EOL maintenance specifically because that’s where security vulnerabilities cluster—unpaid maintainers can’t afford to patch old versions while holding down full-time jobs.

Related: Vibe Coding Hangover: 10.3% of Apps Vulnerable in 2025

Industry Leaders Predict Business Model Collapse

Industry leaders are openly declaring the end of open source as a viable business model. Percona CEO Ann Schlemmer predicts “2025 will be the year open source ceases to gain traction as a business model,” while Buoyant CEO William Morgan forecasts “continued closure, defunding, and relicensing of open-source projects.”

This isn’t doomsaying—it’s based on observable failures. Corporate donations are declining (OSU example). Infrastructure deficits are accelerating (package registries warning of unsustainability). Emergency funds prove insufficient ($20 million sounds large until you compare it to commercial value extracted). University budget cuts eliminate backstops that previously covered deficits.

Moreover, when CEOs of major open source companies publicly predict business model collapse, it signals a tipping point. These aren’t outsiders critiquing—these are insiders trying to make open source work commercially. The predictions align with observable trends: declining donations, infrastructure crises, emergency funds, and an expected relicensing wave as projects seek commercial revenue to survive.

Why Money Can’t Fix This

Every existing funding model has fatal flaws exposed by the 2025 crisis. Corporate sponsorship declines unpredictably—OSU operated for years before donations dried up. Individual donations can’t replace developer salaries. Grants require “concrete deliverables” that maintenance work can’t articulate. Dual licensing triggers community backlash. Furthermore, the fundamental problem: partial funding doesn’t create time for employed developers—it requires salary-replacement level that most projects can’t justify.

Alex Gaynor’s analysis identifies three structural barriers. First, maintainers frame funding around “sustainability”—keeping things the same—rather than specific improvements funders can evaluate. Second, paid obligations kill volunteer motivation; acceptance “comes with expectations” that eliminate the freedom making maintenance enjoyable. Third, partial funding doesn’t help employed developers; meaningful impact requires full salary replacement, yet most projects lack scope for 40-hour weekly investment.

The OSSF proposes “commercial partnerships proportional to usage” and “tiered access models” as potential solutions, but these remain unproven. HeroDevs proves you need a commercial model (their “Never-Ending Support” revenue) to sustain open source donations. Nevertheless, the problem isn’t lack of goodwill—it’s structural. Maintenance work is continuous, unglamorous, and hard to “sell” with concrete deliverables.

This isn’t a funding gap. It’s a fundamental mismatch between how open source works and how funding works.

The Security Time Bomb

The sustainability crisis directly causes security vulnerabilities at massive scale. 86% of codebases contain software with known vulnerabilities. 48% of enterprise vulnerabilities come from EOL software. Maintainer burnout delays or prevents security patches. When maintainers work unpaid, security maintenance is the first casualty—they can’t afford to support old versions, backport patches, or respond to disclosures promptly.

The EU Cyber Resilience Act adds regulatory compliance burden—requiring cryptographic verification, security monitoring, and compliance—without providing funding. Meanwhile, AI/ML automated usage drives what the OSSF calls “wasteful consumption”: more infrastructure load with no contribution increase.

Consequently, this translates abstract “sustainability crisis” into concrete developer consequences: your dependencies are vulnerable because maintainers can’t afford security work. Every npm install or pip install pulls packages that may have unpatched CVEs because the maintainer works unpaid and can’t justify backporting fixes. Companies extract value while externalizing security risk to unpaid maintainers.

The security implications make this more than an economic problem—it’s a ticking time bomb under every production system built on open source dependencies.

What’s at Stake

The 2025 crisis response reveals desperation: HeroDevs’ $20 million fund, the OSSF joint statement from 10 foundations, OSU’s emergency appeal for $250,000, and proposed solutions that remain unproven. These are band-aids, not fixes.

The scale and urgency of emergency responses prove the crisis is real, but their band-aid nature proves there’s no systemic fix yet. When the largest sustainability fund in history looks small compared to the problem scope, and infrastructure hosting critical projects needs emergency appeals just to survive one more year, the model isn’t salvageable—it needs replacement.

Modern software depends on unsustainable volunteer labor. The crisis is here:

• 60% of maintainers work unpaid despite commercial-scale usage
• Emergency funds ($20 million) prove the crisis real but are insufficient
• Industry CEOs predict business model collapse in 2025
• Security impact: 86% of codebases vulnerable, 48% from EOL software
• Infrastructure operates at deficits while serving billions of downloads
• The volunteer model can’t sustain commercial extraction

Every npm install depends on this failing model. The question isn’t whether open source will change—it’s what replaces the broken system before critical infrastructure collapses entirely.