agents don't donate
Package registries are buckling under download growth driven by coding agents. The bandwidth bill is the small problem.
On 16 September the OpenSSF governing board, joined by Arm, Datadog, Dell, Ericsson, GitHub, IBM, Kusari, Microsoft, Red Hat, the Rust Foundation and Sonatype, published a commitment to sustainable funding for public package registries — PyPI, Maven Central, crates.io, RubyGems, npm, NuGet, Open VSX, Packagist. The shape of the commitment: individual developers keep free access, large commercial users pay based on usage, registry fees get treated as a normal business expense, and each registry keeps autonomy over its own model.
Two figures from the statement. Downloads are growing 30–50% year over year, driven largely by agentic coding tools. And 1.8 million malicious packages have already been identified in 2026, exceeding the total for all of 2025.
The funding response is correct and overdue. It also treats the visible half of the problem.
Here is the part nobody is costing. Open source has never been funded by downloads. It has been funded by what downloads led to. A person pulls your library, wires it into something, hits an edge case, files an issue with a decent repro. Six months later they send a patch. Their employer notices the dependency in a compliance audit and sponsors you for a few hundred a month. One in a few thousand of those people eventually becomes a co-maintainer, which is the only mechanism that has ever actually replaced a burned-out maintainer.
Every step in that chain requires a human on the far end of the download.
An agent pulls the tarball and the chain stops at step one. It does not file the issue — or worse, it files a confident, wrong one. It does not become a co-maintainer. It does not notice you in the audit. It generates load shaped exactly like adoption while producing none of adoption’s byproducts.
The download curve and the contribution curve have decoupled, and the download curve is the one everybody instruments.
That’s why the registry bill is the easy part of this. Bandwidth scales with downloads, so enterprise-usage funding tracks the cost honestly — if an agent pulls left-pad ten thousand times a day, somebody should pay for the egress, and now somebody will. Good. Solved, or at least addressed.
Maintenance capacity scales with the other curve. Nothing in the commitment touches it, because money doesn’t convert into maintainers at any published exchange rate. Paying a burned-out maintainer helps them stay. It does not manufacture their replacement. The pipeline that produced replacements ran on human users, and the human fraction of the traffic is falling even as the absolute number grows.
Set that next to the 1.8 million malicious packages and it gets worse. Review capacity is the scarce input for supply-chain defence, review capacity is people, and the people were recruited from the same funnel that agents are now bypassing. Attack surface scaling with machine traffic, defence scaling with human attention.
I don’t have the fix, and I’m suspicious of anyone who says the answer is obviously to charge more. But I’d like the conversation to name the right quantity. The registries are not running out of money. They are running out of the thing money was a proxy for.
Sources: Sustainable Package Registries: An Enterprise Commitment, OpenSSF ↗ · OpenSSF Commitment Backs Enterprise Funding for Public Package Registries, The Drop Times ↗ · Leaders call for commercial funding of open-source platforms, ReversingLabs ↗