Open source software carries an estimated $8.8 trillion in demand-side value - the amount companies would collectively have to pay to rebuild it themselves, according to Harvard Business School’s 2024 study The Value of Open Source Software. Put differently, the same researchers found firms would spend 3.5 times more on software if open source did not exist. That value now underpins nearly every commercial application: Black Duck’s 2025 OSSRA report found 97% of codebases contain open source, and Sonatype logged 9.8 trillion package downloads across the four largest registries in 2025. This analysis consolidates data from GitHub Octoverse, Black Duck OSSRA, Sonatype, Harvard Business School, the Linux Foundation, and 11 other primary sources to map open source by the numbers.
TL;DR
- Open source demand-side value is estimated at $8.8 trillion; firms would spend 3.5x more without it (Harvard Business School, 2024).
- 97% of commercial codebases contain open source, averaging 911 components each (Black Duck, OSSRA 2025).
- GitHub passed 180 million developers, adding 36.2 million in 2025 - about one per second (GitHub, Octoverse 2025).
- India became the #1 source of open source contributors, reaching 21.9 million developers (GitHub, Octoverse 2025).
- Open source consumption hit 9.8 trillion downloads in 2025, up 67% year over year (Sonatype, 2026).
- 454,600+ new malicious packages appeared in 2025 as open source malware grew 75% (Sonatype, 2026).
- 86% of commercial codebases contain known-vulnerable open source components (Black Duck, OSSRA 2025).
- 60% of maintainers are unpaid hobbyists and 60% have quit or considered quitting (Tidelift, 2024).
- Active open source contribution returns a 2.5x average benefit-to-cost ratio (Linux Foundation, 2026).
- The open source software market is valued near $53-57 billion for 2026 (Research and Markets; Business Research Insights, 2026).
1. Adoption: Open Source Is the Default
Open source stopped being a choice and became the substrate. Nearly every application shipped today is assembled largely from components no single vendor controls, and the dependency graph runs deeper than most teams can see. Black Duck found that 64% of open source components in the average codebase are transitive - pulled in indirectly by other dependencies - which is exactly where visibility and patching break down.
| Metric | Value | Source |
|---|---|---|
| Commercial codebases containing open source | 97% | Black Duck, OSSRA 2025 |
| Open source components in the average application | 911 | Black Duck, OSSRA 2025 |
| Components that are transitive (indirect) dependencies | 64% | Black Duck, OSSRA 2025 |
| Organizations that increased or maintained OSS use | 96% | OpenLogic, State of Open Source 2025 |
| Organizations that significantly increased OSS use | 26% | OpenLogic, State of Open Source 2025 |
| Organizations adopting cloud native technology | 98% | CNCF, Annual Survey 2025 |
| Container users running Kubernetes in production | 82% | CNCF, Annual Survey 2025 |
Context: the number of open source files in a typical application tripled from more than 5,300 in 2020 to more than 16,000 in 2024 (Black Duck, OSSRA 2025). For a parallel view of how practitioners actually pick their tools, see our developer survey statistics.
2. Developers and Global Contribution
The contributor base is growing fast and shifting geographically. The headline is not just scale but distribution: for the first time India overtook the United States in open source contributor count, and the fastest growth is coming from emerging markets. GitHub added 36.2 million developers in 2025 - averaging roughly one new developer every second. Yet value creation stays highly concentrated, a tension that defines open source economics.
| Metric | Value | Source |
|---|---|---|
| Total developers on GitHub | 180 million+ | GitHub, Octoverse 2025 |
| New developers added in 2025 | 36.2 million (+23% YoY) | GitHub, Octoverse 2025 |
| Developers in India (now #1 for OSS contributors) | 21.9 million | GitHub, Octoverse 2025 |
| Contributions to open source repos in 2025 | 1.12 billion (+13% YoY) | GitHub, Octoverse 2025 |
| Cloud native developers worldwide (Q3 2025) | 15.6 million | CNCF / SlashData, 2025 |
| Share of OSS demand-side value from top 5% of developers | 96% | Harvard Business School, 2024 |
Outlier: India added 5.2 million developers in 2025, about 14% of all new GitHub accounts, and is projected to reach 57.5 million by 2030 (GitHub, Octoverse 2025).
3. Economic Value and Market Size
Open source’s book value and its use value diverge by three orders of magnitude, and that gap is the whole story. The cost to write the world’s most-used open source once is measured in billions; the cost to replace it across every firm that depends on it is measured in trillions. Harvard pegged demand-side value at $8.8 trillion against a $4.15 billion supply-side cost - a roughly 2,000-to-1 ratio between what open source is worth and what it cost to build.
| Metric | Value | Source |
|---|---|---|
| Demand-side value of open source software | $8.8 trillion | Harvard Business School, 2024 |
| Supply-side (one-time replacement) cost | $4.15 billion | Harvard Business School, 2024 |
| Extra spend on software if OSS did not exist | 3.5x current | Harvard Business School, 2024 |
| Share of demand-side value from top 6 languages | 84% | Harvard Business School, 2024 |
| Average ROI on active open source contribution | 2.5x benefit-to-cost | Linux Foundation, 2026 |
| Top 100 contributors, 2018-2025: benefits vs. investment | $23.2B from $3.9B (6x) | Linux Foundation, 2026 |
| Open source software market size, 2026 | ~$53-57 billion | Research and Markets; Business Research Insights, 2026 |
Divergence note: 2026 market sizing varies by firm - Research and Markets reports $56.57 billion (16.5% CAGR), Global Growth Insights $53.93 billion, and Business Research Insights $53.55 billion; the Harvard valuation is the most-cited academic estimate but dates to 2024. For how this value maps to paid delivery models, see our SaaS statistics.
4. The Package Ecosystem at Scale
Consumption is the metric that best captures open source’s real footprint, and it is accelerating faster than the developer base. Registries now serve traffic at a scale that only cloud infrastructure can absorb. Open source downloads reached 9.8 trillion in 2025, a 67% jump year over year, and the bulk of that pull is automated: 86% of Maven Central traffic now originates from cloud service providers rather than individual developers.
| Metric | Value | Source |
|---|---|---|
| Open source downloads across top 4 registries (2025) | 9.8 trillion (+67% YoY) | Sonatype, State of the Software Supply Chain 2026 |
| Maven Central traffic from cloud service providers | 86% | Sonatype, 2026 |
| Indexed artifacts on Maven Central | 67.8 million | Sonatype, 2026 |
| Total repositories hosted on GitHub | 630 million | GitHub, Octoverse 2025 |
| Most-used programming language (first time) | TypeScript | GitHub, Octoverse 2025 |
| Packages available on PyPI | 614,000+ | PyPI, 2025 |
Context: GitHub added 121 million new repositories in 2025, its biggest year for repo creation, at a rate of roughly 230 new repositories per minute (GitHub, Octoverse 2025).
5. Security and Supply-Chain Risk
Ubiquity created a target-rich attack surface, and adversaries have industrialized their approach. The threat is no longer isolated typosquats but sustained, automated campaigns aimed at the developer tooling that builds everything downstream. Sonatype logged more than 454,600 new malicious packages in 2025, with open source malware growing 75% year over year and over 99% of it landing on npm. Old flaws also refuse to die, keeping remediation debt high.
| Metric | Value | Source |
|---|---|---|
| New malicious open source packages found in 2025 | 454,600+ | Sonatype, 2026 |
| Year-over-year growth in open source malware | 75% | Sonatype, 2026 |
| Packages compromised by the Shai-Hulud npm worm | 500+ (in days) | Sonatype, 2026 |
| Vulnerable Log4Shell downloads still occurring in 2025 | 42 million | Sonatype, 2026 |
| Commercial codebases with vulnerable open source | 86% | Black Duck, OSSRA 2025 |
| Codebases with high- or critical-risk vulnerabilities | 81% | Black Duck, OSSRA 2025 |
| Codebases with components 4+ years out of date | 90% | Black Duck, OSSRA 2025 |
| 2025 CVEs receiving full NVD enrichment | 28% | VulnCheck / NVD analysis, 2026 |
Outlier: only 28% of 2025 CVEs were fully enriched by the National Vulnerability Database, down from 46.2% in 2024, pushing more triage burden onto downstream teams (VulnCheck / NVD analysis, 2026). The supply-chain angle connects directly to broader threat trends in our cybersecurity statistics.
6. Maintainers, Funding, and Sustainability
The economics of who actually maintains open source are the field’s structural weak point. A tiny, largely unpaid population supports code that trillions of dollars of commerce depend on, and that population is stretched thin. About half of the 13,000 most-downloaded npm packages are maintained by a single person, concentrating both knowledge and risk in individuals who are frequently unpaid and close to burnout.
| Metric | Value | Source |
|---|---|---|
| Maintainers who describe themselves as unpaid hobbyists | 60% | Tidelift, State of the Maintainer 2024 |
| Maintainers who have quit or considered quitting | 60% | Tidelift, 2024 |
| Maintainers citing burnout as a reason to leave | 44% | Tidelift, 2024 |
| Paid maintainers more likely to follow security practices | 55% more likely | Tidelift, 2024 |
| Tracked projects maintained by a single person | ~7 of 11.8 million | Socket / ecosyste.ms, 2025 |
| Top 13,000 npm packages maintained by one person | ~50% | Socket / ecosyste.ms, 2025 |
Context: Andrew Nesbitt estimates roughly 10,000 people maintain the critical packages that account for 80% of usage within their ecosystems, underscoring how narrow the base of support really is (Socket / ecosyste.ms, 2025).
7. AI’s Impact on Open Source
AI is now the single biggest force reshaping open source contribution, lowering the barrier to entry for new developers while introducing new failure modes. Six of the ten fastest-growing repositories in 2025 were AI infrastructure projects. Public repositories using an LLM SDK grew 178% year over year to 1.1 million, and autonomous coding agents are already contributing at scale rather than as a novelty.
| Metric | Value | Source |
|---|---|---|
| AI-related repositories on GitHub | 4.3 million | GitHub, Octoverse 2025 |
| Public repos using an LLM SDK | 1.1 million (+178% YoY) | GitHub, Octoverse 2025 |
| Pull requests opened by coding agents (6 months) | 1 million+ | GitHub, Octoverse 2025 |
| Public models hosted on Hugging Face (2025) | 2 million+ | Hugging Face, 2026 |
| Component versions hallucinated by GPT-5 in upgrade advice | 27.8% | Sonatype, 2026 |
| Organizations that have started implementing SBOMs | 78% | ENISA, SBOM Adoption 2026 |
This post covers open source software broadly; for the models, datasets, and licensing debates specific to machine learning, see our dedicated open source AI statistics and AI coding tools statistics. Note: AI hallucinating package names is a live supply-chain risk when those names get published as real malware.
Summary: Open Source Software by the Numbers
| Metric | Value | Source |
|---|---|---|
| Open source demand-side value | $8.8 trillion | Harvard Business School, 2024 |
| Extra software spend without open source | 3.5x | Harvard Business School, 2024 |
| Share of demand-side value from top 6 languages | 84% | Harvard Business School, 2024 |
| Commercial codebases containing open source | 97% | Black Duck, OSSRA 2025 |
| Organizations that increased or maintained OSS use | 96% | OpenLogic, 2025 |
| Total developers on GitHub | 180 million+ | GitHub, Octoverse 2025 |
| Open source downloads in 2025 | 9.8 trillion (+67%) | Sonatype, 2026 |
| Total GitHub repositories | 630 million | GitHub, Octoverse 2025 |
| New malicious packages in 2025 | 454,600+ | Sonatype, 2026 |
| Growth in open source malware | 75% | Sonatype, 2026 |
| Codebases with vulnerable open source | 86% | Black Duck, OSSRA 2025 |
| Codebases with 4+ year-old components | 90% | Black Duck, OSSRA 2025 |
| 2025 CVEs fully enriched by NVD | 28% | VulnCheck / NVD, 2026 |
| Maintainers who are unpaid hobbyists | 60% | Tidelift, 2024 |
| Active contribution ROI | 2.5x | Linux Foundation, 2026 |
| IT leaders viewing enterprise OSS as secure or more secure | 84-87% | Red Hat, 2025 |
| Cloud native developers worldwide | 15.6 million | CNCF / SlashData, 2025 |
| AI-related repositories on GitHub | 4.3 million | GitHub, Octoverse 2025 |
| Public models on Hugging Face | 2 million+ | Hugging Face, 2026 |
| Open source software market, 2026 | ~$53-57 billion | Research and Markets, 2026 |
Methodology and Sources
Data was gathered by tracing every figure to its primary report, survey, or dataset published by the originating organization, prioritizing 2025-2026 editions and flagging older data where it is the most recent available.
- GitHub, Octoverse 2025 - developer, repository, contribution, and AI metrics.
- Black Duck, Open Source Security and Risk Analysis (OSSRA) 2025 - codebase composition and vulnerability data (analysis of 965 commercial codebases across 16 industries during 2024).
- Sonatype, State of the Software Supply Chain 2026 - download volumes, malicious package counts, and AI dependency findings.
- Harvard Business School, The Value of Open Source Software (Working Paper 24-038), 2024 - demand-side and supply-side economic valuation.
- Linux Foundation, ROI for Open Source Software Contribution, 2026 - contribution ROI and benefit-to-cost ratios.
- OpenLogic by Perforce, State of Open Source Report 2025 - enterprise adoption and end-of-life risk.
- CNCF, Annual Cloud Native Survey 2025 and CNCF / SlashData State of Cloud Native Development 2025 - cloud native adoption and developer population.
- Tidelift, State of the Open Source Maintainer 2024 - maintainer compensation, burnout, and security practices.
- Socket / ecosyste.ms, 2025 - single-maintainer concentration data (Andrew Nesbitt / ecosyste.ms).
- Red Hat, State of Enterprise Open Source (1,296 IT leaders across 14 countries) - security perception and sector adoption.
- VulnCheck / NVD analysis, 2026 - CVE enrichment backlog.
- ENISA, SBOM Adoption State of Play 2026 - software bill of materials adoption.
- Hugging Face, State of Open Source Spring 2026 - open model repository counts.
- Research and Markets / The Business Research Company; Business Research Insights; Global Growth Insights, 2026 - market sizing (cross-referenced, ranges reported).
- PyPI, 2025 in Review - Python package registry scale.
Data watch: several core sources refresh on an annual cadence. GitHub Octoverse publishes each autumn (next edition expected late 2026), Black Duck OSSRA lands in Q1 (next edition expected February 2027), Sonatype’s State of the Software Supply Chain and the CNCF Annual Survey both refresh yearly, and the Stack Overflow Developer Survey and Tidelift maintainer survey are due for new editions. We will update figures as those reports land.
Last updated: July 16, 2026. We review and update this page quarterly as new data is published.