FOSS Data
Follow the people, dependencies, and security signals shaping open source. Explore the evidence. Ask your own questions.
Based on the Exodos Labs provenance dataset.
Commit activity is concentrated in a small contributor cohort.
Explore this visualResearch signals
Source-backed evidence on concentration, control, identity, and exposure across the software supply chain.
Geography & origin
The US share of new contributors fell from 25.7% in 2018 to 18.8% in 2024, while China rose from 10.6% to 16.6% and India from 4.5% to 7.3%.
Read the evidenceConcentration & risk
The top 1% of human contributors — roughly 7,800 people — produce 60.9% of all commits.
Read the evidenceConcentration & risk
76.6% of all packages are maintained by a single person.
Read the evidenceEcosystem personality
Bot-authored commits rose from 0.1% in 2015 to 9.8% in 2025.
Read the evidenceIdentity & privacy
The share of new contributors using GitHub's anonymous email climbed from 2.9% in 2014 to 39.6% in 2024.
Read the evidenceHygiene & licensing
Repositories with no release in two years average 2.6/10 on the Scorecard, against 4.5 for active ones.
Read the evidenceManaged publication
All figures in this panel share the publication dates shown above.
Research with a purpose
Software is a shared foundation. Understanding who maintains it, where responsibility concentrates, and how security signals change should not be reserved for a few. FOSS Data makes that research easier to explore, question, and put to work.
An initiative from Exodos Labs. Built for maintainers, security teams, researchers, and curious minds.
Why we do thisEvidence library
Navigate the published evidence by the questions shaping software supply-chain risk.
2026 annual report
A research-led view of the people, packages, and exposure beneath the software the world relies on.
Explore the annual report