Open source registries don't have enough money to implement basic security

A FOSDEM 2026 talk by Alpha-Omega’s Michael Winser highlights that major open source registries (e.g., PyPI, npm, Crates.io, RubyGems, Maven Central) face severe, growing operational and security costs amid thin, inconsistent funding, jeopardizing the integrity of the software supply chain. Key cost drivers include bandwidth, storage, compute, and malware response, with 845,000 malicious packages detected since 2019 and a median of 39 hours to remove them (e.g., the Shai-Hulud npm outbreak). Multiple monetization and support models (bandwidth charges, app-store fees, subscriptions, publisher fees, enterprise features) present ecosystem and practicality challenges. The talk urges organizations to treat funding for registries as a standard operating expense to sustainably support essential security capabilities.