Here’s the thing. Almost all open source is literally one person. What I mean by that is if you look at all the open source projects out there, and there are a lot, we see a pattern of one person no matter how we slice and dice the data.
…
Open source, the thing that drives the world, the thing Harvard says has an economic value of 8.8 trillion dollars (also a big number). Most of it is one person. And I can promise you not one of those single person projects have the proper amount of resources they need. If you want to talk about possible risks to your supply chain, a single maintainer that’s grossly underpaid and overworked. That’s the risk. The country they are from is irrelevant.
https://opensourcesecurity.io/2025/08-oss-one-person
Credits
Open Graph image from https://xkcd.com/2347/