About the publication
About FOSS Data
Open source is a shared foundation. Understanding it should be a shared opportunity.
Our mission: make the invisible dependencies visible.
Behind every application is a network of people, packages, and maintenance decisions. Much of that work is easy to depend on and difficult to see. FOSS Data turns evidence about the open-source software supply chain into research that people can understand, challenge, and use.
We want better questions to lead to better decisions: where support is most needed, which security signals deserve attention, and how the ecosystem changes over time. Our role is to make the evidence and its limits clear—not to turn an incomplete metric into a verdict on a project or its maintainers.
For the people building it
Recognise the work. Understand the pressure.
Maintainer concentration and contribution patterns can help explain where responsibility accumulates. Use the findings to start informed conversations about support, sustainability, and shared responsibility.
For the people protecting it
Give security decisions more context.
Study maintenance activity, ecosystem differences, and published security signals together. Look beyond a single score, inspect the methodology, and distinguish evidence from inference.
For anyone asking why
Make research a starting point, not a closed door.
Researchers, journalists, educators, and curious readers can explore public samples, then create a free account for the full library, reports, and available live aggregate analysis.
Our vision: a more understandable software ecosystem.
When the evidence is easier to inspect and discuss, more people can participate in improving the systems we share. We aim to connect rigorous measurement with useful explanations, accessible graphics, and tools that let readers follow their own questions.
Start with a published finding. Check its source and measurement date. Explore the available aggregate evidence in Research Studio. Take what you learn back to your team, your project, or your next research question.
Editorial standards
Every edition identifies its source, measurement date, publication date, calculation notes, and limitations. FOSS Data publishes aggregate research; it does not present customer records or identifiable production SBOM data.
FOSS Data is operated by Exodos Labs, Inc. The operator is identified in the legal notice, privacy policy, terms of use, and source attribution where that relationship is relevant.
Public previews and methodology are available without an account. A free verified account unlocks deeper research and official downloads. Registering does not subscribe you to marketing email. Our methodology and reuse guidance explain how to interpret and cite the work.