Modern software is built on a foundation of open-source components, but many of those components are maintained by a small number of low-paid or unpaid volunteers. A report covered by Tom's Hardware warns that this arrangement leaves critical infrastructure exposed, as the people responsible for security fixes often lack the time and resources to keep up.
The report details projects that are critically underfunded, understaffed, or entirely unfunded. This leads to a low "bus factor"—the risk that a project stalls or becomes insecure if a key maintainer steps away. Without adequate support, vulnerabilities can go unpatched for long periods, opening the door to potential threats.
The article notes that this is a perennial problem, not a new one. Despite years of awareness, funding and manpower for voluntary-maintained infrastructure have not improved, meaning the software supply chain remains vulnerable to the same risks today as it has been in the past.