We’re used to thinking that the digital world rests on corporations, data centres and multi-billion-dollar tech giants.
The reality is far less monumental. Very often the smooth running of the services we rely on comes down to one person — with no team, no safety net and no obligations to the people who use their code in production.
And this isn’t a pretty metaphor. It’s plain statistics.
By the count of Josh Bressers of Anchore, based on data from the ecosyste.ms catalogue (August 2025), there are about 11.8 million open-source projects in the world, and roughly 7 million of them are run by a single maintainer. One person is responsible for the architecture, security, updates, bug fixes and communication with users.
Even in the npm ecosystem, by the same count, things are no better. Of the 13,000 most popular packages, the ones downloaded more than a million times a month, almost half are one-person projects. These aren’t fringe libraries but key dependencies built into thousands of production builds around the world.
And this is where the real problem begins.
It’s not about where the developer lives. It’s not about their views. It’s that if they get hit by a bus tomorrow, there will be no more updates.
Most of these projects have what’s known as a bus factor = 1. Losing one person means development stops, vulnerabilities go unpatched and the code that companies, products and users depend on has no future.
What’s more, maintainers often work for free. In Tidelift’s 2024 survey, 60% of maintainers described themselves as unpaid hobbyists, and 47% said they get nothing at all for their work. They pay with their own time, nerves and health, and put up with toxic comments and demands along the lines of “fix it now, our prod is going down”, while owing nobody anything.
In response, businesses are trying to come up with stopgaps. Initiatives are appearing in which companies publicly pledge to fund the open-source projects they depend on. The idea is sound, but so far it doesn’t change the systemic picture: critical infrastructure still rests on the enthusiasm of individuals working alone.
That said, not every such case is bound to end in disaster. There are examples of the community quickly picking up an abandoned project, restoring the packages and closing vulnerabilities in a mad rush. Sometimes the ecosystem really does manage to organise itself.
But each time it follows the same script:
first, panic and cries of “it’s all over”,
then urgent fixes and heroics,
and then collective relief and the illusion that “we’ve learned our lesson”.
And then it all happens again.
The conclusion is simple and unpleasant: open source isn’t faceless “community magic”. It’s millions of real people, often single-handedly maintaining the code that modern digital civilisation stands on. And as long as we keep treating it as a free and endless resource, our infrastructure remains an inverted pyramid, stable right up until its first bad day.
The flip side of the same dependence is when a vendor’s decision forces you to switch an entire operating system just to keep working hardware: CERN is moving 2,200 machines from RHEL to Debian.
