A Research Lab for Open Source ✸ Software Stewardship Lab
← All ideas<br>Philosophy<br>idea
A Research Lab for Open Source<br>Author Vlad-Stefan Harbuz
Date 7 Aug 2026
Today, we're launching a world-class research lab dedicated to Open Source sustainability with a team of some of the<br>most experienced people in the world.
Why? The infrastructure we all use depends on Open Source: transportation, healthcare, the internet and more.<br>When the Open Source packages we use break, our infrastructure is at risk.<br>This isn't just hypothetical. It's happening already, with catastrophic global supply chain attacks such as the XZ Utils<br>backdoor, Log4Shell, Shai-Hulud and others.<br>There are efforts underway to make Open Source development more sustainable.<br>The Open Source Pledge has raised $7,262,189 for maintainers,<br>the Open Source Endowment is nearing a principal of $1m,<br>and excellent research is being done by<br>the Sovereign Tech Agency,<br>Alpha-Omega<br>and others.<br>But we need an organisation dedicated to answering the more general questions that Open Source sustainability depends<br>on. What are the most critical keystone packages? Which keystone packages appear to be maintained, but are<br>actually long-dead Bernies? Which dependencies are invisible to us? How can we prevent the<br>ever-growing issue of maintainer burnout?<br>One would think that one of the many well-funded Open Source foundations could tackle this research, with<br>a median yearly revenue of $1.6m and a mean of $11.6m. But for the most part, foundations, as a policy, do not pay<br>developers at all, so they cannot fund this work. This is partly a quirk of the US tax code — until the Feb 2026 launch<br>of the Open Source Endowment, the IRS had not recognised Open Source software as serving the public benefit, so they had<br>not given 501(c)(3) status to any organisation that primarily funds Open Source development.<br>What about for-profit companies? Some, like Chainguard and Socket are building software supply<br>chain analysis tools. But this work is proprietary, which doesn't sit right with our vision. The tools that allow us to<br>monitor our critical infrastructure are themselves critical infrastructure, so they should be publicly accessible, and<br>funded independently of for-profit interests.<br>That's why we founded the Software Stewardship Lab: a new non-profit research lab dedicated to ensuring the stability of<br>the Open Source ecosystem we all depend on.<br>We map and strengthen the Open Source ecosystem by building software, creating APIs, and writing research reports. And<br>our research takes into account the human side of Open Source, by investigating and caring for maintainer health.<br>Our team includes some of the most experienced people in the field:<br>Vlad-Stefan Harbuz, director of the Open Source Pledge and adviser to the Open Source Endowment.<br>Andrew Nesbitt, creator of ecosyste.ms and probably the world's foremost expert on package<br>management.<br>Miranda Heath, author of the to-date most comprehensive report on burnout in Open Source.<br>Dawn Foster, CHAOSS board member, with a PhD using metrics to study the Linux kernel.<br>Daniel Roe, leader of globally-used web framework Nuxt and a steward of npmx.<br>Matias Capeletto (patak), also a steward of npmx, and a legendary Open Source community leader.<br>Mike McQuaid, leader of Homebrew and a former GitHub Principal Engineer.<br>We are registered as a Scottish non-profit — though our scope is global — and our values<br>and articles legally bind us to serving the public good and making all our work publicly accessible.<br>Our independent non-executive directors hold us accountable.
“If we don't secure the software supply chain, the vast majority of software will suffer. The Software Stewardship<br>Lab has a collection of world-class experts in addressing problems like this and represents perhaps the most<br>ambitious effort today to solve the key problems in a fundamental manner.”
Our current research focuses are:<br>Software supply chain security — We're working on an observatory that allows users to identify and monitor the<br>world's critical Open Source packages in real time, including previously hidden parts of the dependency<br>graph. More details here.<br>Maintainer burnout — Our report on burnout in Open Source has been well-received. We're working on<br>yearly follow-ups, plus a companion report on how AI is affecting maintainer burnout.<br>Moving forward, the Lab's experts will direct funding to and supervise Open Source sustainability researchers doing<br>critical work. We are already working with universities to teach the next generations of software supply chain experts.<br>And we are also working with our solicitors on achieving charity status. Charity regulators have not historically<br>recognised Open Source software as a charitable purpose. We hope that by seeking charity status, we will help pave the<br>way for charity regulators worldwide to recognise the criticality of Open Source infrastructure.
“This effort is critical to the future sustainability of Open Source. The unique...