EXANTE calls out the underfunding of widely used open source projects

The Invisible Infrastructure Problem

A new warning from investment platform EXANTE has put fresh emphasis on a problem that has quietly simmered in the technology industry for years: the chronic underfunding of open source software that underpins much of the modern enterprise stack. EXANTE's framing is memorable—open source as the "plumbing" of enterprise systems—and it captures why this issue keeps resurfacing every time a critical vulnerability or maintainer burnout story makes headlines.

Why This Matters Now

Open source components are embedded everywhere, from cloud infrastructure to financial trading systems to the mobile apps millions use daily. Yet the maintainers behind many of these widely used projects often work as volunteers, or with minimal institutional backing, despite their code being relied upon by companies generating billions in revenue. This mismatch between usage and investment has repeatedly surfaced in security incidents over the past several years, where a single under-resourced library became a chokepoint for widespread vulnerabilities across countless downstream applications.

When a foundational dependency goes unmaintained or under-patched, the ripple effects can be severe. Security researchers have long argued that the software supply chain is only as strong as its weakest, often least-funded, link. EXANTE's comments arrive at a moment when enterprises are increasingly auditing their software bills of materials (SBOMs) and grappling with how much of their infrastructure quietly depends on projects maintained by a handful of unpaid contributors.

The Trending Projects Angle

This underfunding dynamic also intersects with how open source projects rise in popularity. Trending repositories often gain massive adoption quickly—driven by developer enthusiasm, ease of integration, or being bundled into popular frameworks—without a corresponding increase in maintainer resources or security review capacity. A project can go from niche to mission-critical in a matter of months, while its funding and staffing remain unchanged. That gap is precisely where vulnerabilities tend to fester unnoticed until exploited.

What Could Change

EXANTE's call-out adds to a growing chorus, including initiatives like the Open Source Security Foundation and corporate-backed funding pools, aimed at directing more resources toward critical dependencies. However, sustainable funding models remain elusive. Corporate sponsorship, government grants, and foundation-backed initiatives have made incremental progress, but coverage remains uneven and reactive rather than proactive.

The Bigger Picture

As enterprises continue to build atop open source foundations, the economics of maintenance versus usage will likely remain a flashpoint. Analysts increasingly view sustainable funding not as charity toward open source developers, but as a basic form of risk management—akin to insuring the physical plumbing that keeps a building standing. Whether EXANTE's remarks spur concrete action or simply add to the ongoing conversation remains to be seen, but the underlying tension between free software and its outsized commercial value isn't going away soon.