Concentration & risk
Even the most popular projects rest on one person
76.6% of all packages are maintained by a single person.
- Headline statistic
- 76.6%
- 2026 edition
Single-maintainer package rates by ecosystem
PyPI has the highest supplied single-maintainer rate at 89.3%; npm has the lowest of the compared ecosystems at 51.5%.
Rates count packages with one distinct maintainer in each supplied ecosystem.
Source: FOSS Data — https://www.fossdata.org
Interactive visualization is optional. Exact values are available in the data table below.
Data table
Scroll horizontally to review every data column when needed.
| Ecosystem | Single-maintainer packages |
|---|---|
| PyPI | 89.3% |
| NuGet | 86.5% |
| RubyGems | 77.4% |
| npm | 51.5% |
Supporting explanation
76.6% of all packages are maintained by a single person. Among packages with over 10,000 stars, 59.8% are still solo-maintained, versus 78.8% for everything else — the exact shape behind the xz-utils backdoor.
Publication details
- Category
- Concentration & risk
- Applicable filter
- Category: Concentration & risk
- Edition
2026 edition
Measured 25 June 2026
Published 2 August 2026
- Source
- Based on the Exodos Labs provenance dataset.