In January the author of colors and faker broke both packages on purpose. faker 6.6.6 came out without the code and colors started to print “LIBERTY LIBERTY LIBERTY” in an endless loop. It hit everyone whose install picked up the new version. In November 2020 he had already written on GitHub that there would be no more free work from him. The threads I read were mostly about whether he had the right to do it. I had a different question and no answer to it. Who maintains the packages under my node_modules and does anybody pay them?
npm has printed “N packages are looking for funding” after install since version 6.13 in 2019. I always scrolled past this line. So I decided to count, before the year ends.
What I took
The list is npm-high-impact 1.1.0 from November 2022. Its author collected the packages that match the definition npm uses for high impact. I took the part with 1 million downloads per week or more, 4366 packages. For each one I took the newest stable version published before 28 December 2022. From that version I read the npm accounts that can publish it and the README inside its tarball. So the text is what the authors wrote this year. Downloads are from the npm API for 1 January to 27 December 2022. 4 packages with 2 letter names (yn, pn, rx, is) get 0 from the API. 4362 are left, with 2.0 trillion downloads together.
Before the first number I wrote down what I expected. More than half of the downloads come from packages with 1 or 2 maintainers. Less than a third of packages ask for money. And on Open Collective, where the money a project receives is public, less than 1 dollar per million downloads.
Who holds them
The median package in the list has 2 maintainers. 2086 packages, 48% of the list, have exactly 1 and they give 47% of all downloads. Packages with 1 or 2 maintainers give 65% of the downloads, so the first expectation holds.
Then I counted accounts and not packages. I picked accounts greedily: first the account whose packages give the most downloads, then the one that adds the most new downloads and so on. A package counts as covered when at least one of its maintainers is picked. 3 accounts cover a quarter of all downloads and 12 accounts are enough for half. One account, sindresorhus, is a maintainer on 274 packages with 14% of all downloads. On 222 of them he is the only one. has-flag and find-up are among them.
An npm account is not a person. 170 of the packages with 1 maintainer belong to “types”, the bot that publishes DefinitelyTyped. “fb” publishes React and Jest packages. The median package with 1 maintainer is 7 years old. 1579 of them are older than 5 years and at least 460 of those had a new release this year.
What they write
731 packages have the funding field in package.json. This field is what npm fund and the line after install read. With sponsor links in the README it is 812 packages, 19% of the list and 26% of the downloads. The second expectation holds. GitHub Sponsors is the most common link with 478 packages, Open Collective has 302. Another 205 READMEs mention a Tidelift subscription. Tidelift sells a subscription to companies, so I did not count it as asking.
I searched the READMEs for words about the people behind the code: volunteers, free time, spare time, hobby project, not backed by a company. My word list found 13 packages out of 4362. When I read other READMEs I saw that it misses some. ioredis, for example, says that open source is hard and time consuming. So it is at least 13 of 4362. Some of them:
core-js, 2.1 billion downloads this year, one maintainer. Above the text there is a heading “As advertising: the author is looking for a good job” and then the text:
core-jsisn’t backed by a company, so the future of this project depends on you.
webpack:
Most of the core team members, webpack contributors and contributors in the ecosystem do this open source work in their free time.
msw, created in 2018, 61 million downloads:
Despite that, this library remains a hobby project maintained in spare time
In the same sentence it says that it cannot pay even one contributor to work on it full time.
core-js also has a postinstall script that prints the same request into the terminal. I installed it with npm 6.14 and the request was there. With npm 8.19 it was not, because npm 7 and newer hide the output of install scripts. The funding line was printed by both.
How much money is visible
Open Collective publishes the books of every collective. I asked its API how much each collective linked from these packages received in 2022.
My first sum was almost 2 million dollars and it looked too good. Then I saw airbnb with 200,000 and salesforce with 44,000 in the list. These are funds that give money. Their logos are in the sponsor list of the eslint README and my regex took every Open Collective link. I kept only accounts of the collective type and removed 3 links that point to another project in an example. After that it was 1.65 million dollars for 75 collectives. They are linked from 286 packages with 5% of all downloads.
That is 16 dollars per million downloads. My expectation was less than 1, so here I was wrong by more than 10 times.
The top 5 collectives (babel, eslint, socketio, webpack, nest) received 53% of the money. Together the lower 38 received 23,824 dollars for the whole year and 25 collectives received less than 1000 each. The core-js collective received 11,377 dollars. It is linked from 3 packages with 3.8 billion downloads together, about 3 dollars per million.
The packages with 1 maintainer are almost not in this picture. Only 3% of their downloads come from packages that link any collective. 481 of the 2086 ask for money at all, 386 of them through GitHub Sponsors. GitHub Sponsors does not publish amounts, so for these packages I have no number.
What I did not check
Money from employers. Some maintainers are paid by their employer for this work. The npm CLI team at GitHub is an example, its accounts darcyclarke and nlf are in the list too. npm does not show such money and I did not search the READMEs for it.
Amounts on GitHub Sponsors and Patreon are not public, I only counted the links. Downloads include CI and mirrors and they are not people. The money of a collective goes to the whole project. I divided it only by the downloads of the packages from my list that link to it, so dollars per download are rather too high. MUI is not in the sum, because its README links an address that the API did not resolve.