Report: Critical Open-Source Software Relying on Few Maintain
A new analysis reveals that many essential open-source projects are maintained by only one or two volunteers, creating significant security risks for modern computing infrastructure.
Key points
- Eleven of twenty-three critical open-source projects have only one or two maintainers.
- Funding for these essential software projects is generally scarce or nonexistent.
- Past incidents like Log4Shell and Shellshock highlight the risks of under-resourced codebases.
A recent report by The Data Drop highlights a systemic vulnerability in modern computing infrastructure: critical open-source software is often maintained by very few people. According to the analysis, eleven out of twenty-three listed critical projects currently rely on only one or two maintainers. This low bus factor creates a perennial threat to global digital systems.
The report notes that funding for these voluntary-maintained infrastructure pieces is generally scarce and sometimes nonexistent. With such limited manpower, the likelihood of undetected vulnerabilities or maintenance failures increases significantly. The ubiquity of these libraries means that when something breaks, the impact tends to be spectacular and widespread across the technology sector.
Historical Precedents for Understaffed Risks
History demonstrates how under-resourced projects can lead to major security incidents. In 2014, the Shellshock vulnerability affected the Bash shell on Linux, macOS, and Unix-type systems. The flaw stemmed from code present since 1989. Bash is almost exclusively maintained by Chet Ramey, illustrating how long-standing code can harbor issues when oversight is limited.
In 2016, ImageMagick, a widely used image manipulation library, was exploited for remote code execution. A 2020 analysis found hundreds of security issues in its codebase over the years. Recent contributions have been dominated by Dirk Lemstra, raising concerns about the concentration of responsibility for such a pervasive tool.
Recent Exploits and Current Examples
More recent events further underscore the dangers of low maintainer counts. The 2021 Log4Shell exploit targeted the Apache Log4j logging library, which is used in millions of servers. This critical vulnerability demonstrated the risks associated with widely used components.
In 2023, the libwebp image-handling library suffered a zero-day vulnerability. The following year, in 2024, the xz compression library used across Linux and iOS was compromised. These incidents show that the threat is not historical but ongoing, affecting contemporary software stacks that businesses and consumers depend on daily.
Who Is Affected by Low Maintainer Counts
Specific repositories identified as being under threat include core infrastructure components. The main time-zone file used across Linux-based operating systems is maintained pro bono by Paul Eggert, a UCLA teacher. This essential component affects system timekeeping for countless servers and devices worldwide.
Another critical project is Core-js, which enables new JavaScript features in older browsers. Estimated to be used in half of the busiest websites globally, it is handled by Denis Pushkarev. The low number of overall maintainers and the unpaid nature of the work make it unattractive to perform.
What should you do?
Organizations should assess their dependency on open-source libraries with limited maintainer teams. Monitoring security advisories for widely used components like Bash, ImageMagick, and Log4j is essential. Companies should consider contributing resources or funding to these projects to improve their security posture and stability.
What to do and how to stay safe: open-source
- Audit your software supply chain to identify dependencies on projects with few maintainers.
- Subscribe to security advisories for critical libraries such as Bash, ImageMagick, and Core-js.
- Evaluate the funding status of key open-source components used in your infrastructure.
- Plan for rapid response if a vulnerability is disclosed in a widely used, under-staffed library.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many critical open-source projects have only one or two maintainers?
According to The Data Drop report, eleven out of twenty-three listed critical projects have only one or two maintainers.
Which recent vulnerabilities are cited as examples of this risk?
The report cites Log4Shell (2021), a zero-day in libwebp (2023), and the xz compression library compromise (2024).
Who maintains the Core-js library used by many major websites?
Core-js is handled by Denis Pushkarev, and is estimated to be used in half of the busiest websites in the world.
