Open Source projects in the JS ecosystem that are typically directly depended on are widely known: React, Babel, TypeScript, Vue, node.js, etc. These projects are affirmatively chosen by millions of humans. They get the lion's share of the (wildly insufficient) amount of available funds, contributions, sponsorships, and contributors.
What about the proverbial
xkcd 2347 maintainers? Typically transitive dependencies, who are affirmatively selected by a mere dozens of humans, but whose code runs on hundreds of millions of developer machines, and serves billions of users? These projects are unknown, unsung, underfunded, and under-considered. Virtually every impactful security incident in the npm ecosystem has been due to a transitive dependency maintainer either going rogue, having their account taken over, or handing over the reins to an unvetted contributor - what levers can we apply to support these people's stability and vigilance?
As a prolific maintainer of almost entirely this category of package, Jordan Harband will offer his perspective on what proactive steps companies, governments, and individuals can take to improve this reality.
