Ishan Sachdeva argues that former npm CTO Laurie Voss’s proposal for package registries to add enterprise subscription tiers and automatically distribute a fixed percentage of that revenue down every paying customer’s dependency tree is the first funding fix that asks neither companies to volunteer nor maintainers to beg, but warns its pro-rata payout formula would still starve the maintainers of the few packages a build actually depends on. He ties the piece to the September 2026 OpenSSF statement signed by 13 organizations, including GitHub, Google, IBM, and Microsoft, that called commercial-scale use without commercial-scale support unsustainable, and contrasts the registry levy with earlier license changes, sponsorship tiers, and open-core pivots.
npm's registry-royalty plan is real but still pays the wrong maintainer
Ishan Sachdeva argues that former npm CTO Laurie Voss's proposal for package registries to add enterprise subscription tiers and automatically distribute a fixed percentage of that revenue down every paying customer's dependency tree is the first funding fix that asks neither companies to volunteer nor maintainers to beg, but warns its pro-rata payout formula would still starve the maintainers of the few packages a build actually depends on. He ties the piece to the September 2026 OpenSSF statement signed by 13 organizations, including GitHub, Google, IBM, and Microsoft, that called commercial-scale use without commercial-scale support unsustainable, and contrasts the registry levy with earlier license changes, sponsorship tiers, and open-core pivots.
Source: Ishansa