Package registries were free, volunteer-run and taken for granted. Rising costs and a run of supply-chain incidents have changed that. Commercial mirrors now offer provenance checks, retention guarantees and support contracts, and enterprises are paying.
What this means for maintainers
Some registries are passing revenue back to projects. Others are adding verification requirements that small maintainers find burdensome. The balance between security and openness is being negotiated in public.
Key takeaways
- Commercial mirrors sell provenance and support
- Enterprises are paying for registry guarantees
- Maintainer burden is rising
This story is part of our ongoing coverage of software & apps. We will update it as more details emerge.
