Linux Foundation Report Reveals Why Companies Fork Open Source Projects and Maintain Internal Patches
A recent Linux Foundation Research survey of 567 specialists examines how organizations handle modifications to open source components they depend on. The February report titled ROI for Open Source Software Contribution reveals that companies rarely leave external code untouched once it enters production systems.
Many teams add missing functionality, improve integration with internal systems, or accelerate security fixes that upstream maintainers cannot deliver on schedule. Some of these changes are contributed back, while others remain in long-lived private branches. The study focuses on practical patterns of contribution, forking, and the resulting security and maintenance challenges.
Survey Participants and Methodology
The research was conducted in October and November 2025 among subscribers, participants, and partner communities of the Linux Foundation. After validation, 567 respondents remained. Participants averaged 12 years of open source experience and 14 years in IT overall. Developers, engineers, and architects made up 28% of the sample, while 19% worked in systems administration and infrastructure.
Company sizes varied: 29% from organizations with fewer than 250 employees, 31% from mid-sized firms (250–4,999), and 40% from enterprises with 5,000 or more staff. Fifty-one percent represented IT vendors, 35% came from non-IT businesses, and 14% worked in government, non-profit, or educational institutions.
Contribution Patterns and Forking Practices
Seventy-two percent of organizations that use open source also contribute to it. Contributions extend beyond code to documentation, testing, user support, event organization, and project governance. Technical changes show clear business motivations: organizations most often fix components their products already rely on, yet a substantial share also implement new features.
Common working models include using components unchanged (68%), returning patches upstream (49%), maintaining internal forks (45%), hiring external specialists (28%), and participating in project governance (26%). Many organizations apply different strategies to different components.
Reasons for Internal Forks
Among 238 respondents who answered questions about forking, 54% cited development of proprietary features and 44% mentioned integration with internal systems. Security fixes and regulatory requirements were noted by 37%. Additional drivers included slow or abandoned upstream projects (34%), bug fixes (32%), faster release cycles (29%), quality and stability concerns (28%), performance optimization (25%), and license compatibility (18%).
The average organization maintains 86 internal forks, spending 60 hours on each per release cycle. Larger companies show significantly higher numbers: enterprises with 5,000+ employees average 136 forks and 11,152 total hours per cycle.
Security and Supply-Chain Implications
Internal forks create new vulnerability management challenges. A private security patch may leave the component appearing vulnerable in standard scanners if the public version number is retained. Conversely, a fork may miss subsequent upstream fixes. Proper tracking requires recording the exact upstream commit, the list of internal patches, and an owner responsible for synchronization.
The report also shows the largest gaps between business-critical technologies and actual contributions in programming languages and runtimes (53% critical vs 17% contributing), databases (56% vs 25%), and operating systems (59% vs 29%). Thirty-six percent of respondents reported frequent product delays due to missing features or fixes, rising to 54% among the largest organizations.
Active participation yields measurable benefits: 44% of contributors frequently secure desired features in project roadmaps, 55% receive faster responses on bugs and security issues, and 66% report accelerated product development. The study underscores that sustained engagement with upstream projects reduces long-term technical debt when internal branches would otherwise become permanent, untracked products.
Related articles
OIDC Configured but GitHub Actions Still Vulnerable: Megalodon and actions-cool Attacks Expose Runner Risks
Even after widespread adoption of OIDC for temporary cloud credentials in GitHub Actions, two major attacks in May 2026 demonstrated that the approach remains insufficient on its own. Attackers compromised actions-cool/issues-helper by substituting action tags to execute malicious commits that read Runner.Worker memory. The Megalodon campaign injected malicious workflows into 5,561 public repositories, harvesting environment variables, credential files, kubeconfig, SSH keys, and OIDC tokens. OIDC eliminates long-lived AWS_ACCESS_KEY_ID secrets but leaves short-lived tokens exposed inside the runner during job execution. Four mandatory protection layers are now required: strict cloud trust policies using StringEquals on the sub claim, job-level id-token: write permissions, outbound traffic controls such as Harden-Runner, and CODEOWNERS enforcement on .github/workflows/. GitHub Environments with mandatory reviewers add an essential human-approval gate that would have disrupted the Megalodon attack path.
GitHub Repo Trap with 1774 Stars Mimics Microsoft Activation Scripts to Deliver Malware via Telegram Bot
A security researcher built a Telegram bot that daily delivers five trending GitHub repositories from trendshift.io along with README summaries. One repository named Microsoft Activation Scripts contained only a README with a reversed PowerShell command that decoded to download and execute a payload from a lookalike domain. The account was created 94 seconds before the repository and used classic one-liner installation syntax to blend with legitimate projects. Analysis of 321 trending repositories showed that simple filters such as recent account age or irm|iex patterns would incorrectly flag many legitimate projects including codex and opencode. Two independent detection rules were developed: one that normalizes and scans for obfuscated execution commands including base64, mshta, certutil and hidden window flags, and another that flags one-time owners created less than 30 days before the repository with under 10 KB of content. An additional groundedness check using the AIHOT method prevents DeepSeek from inserting unverified claims such as Ruby or Cypress into repository summaries.
GhostAction Campaign Expands to Inject Malicious GitHub Workflows Stealing AWS Keys and Tokens
The GhostAction campaign has returned with an expanded technique that targets a wider range of credentials across hundreds of repositories. On October 8, two compromised maintainer accounts injected a malicious workflow named security-audit.yml into 346 GitHub repositories, including high-profile projects such as uber/athenadriver and kitao/pyxel. The workflow disguises itself as a security audit routine and executes automatically on every code push, exfiltrating credentials via HTTP requests to attacker-controlled servers. Unlike previous waves that only harvested GitHub Actions secrets, the new version also scans the working directory and full git history for forgotten credentials in older commits. Targeted data includes AWS access keys, GitHub and GitLab tokens, Google API keys, Slack and SendGrid tokens, OpenAI and Anthropic credentials, PyPI passwords, and crates.io tokens. Since October 7, more than 500 GitHub accounts have planted similar workflows, building on earlier campaigns that affected 817 repositories in September 2025 and 772 between August and September.
Security Researcher Builds SAST Scanner for AI-Generated Code and Audits 3,800 Public Repositories
A developer released AigisSAST, a lightweight open-source static analysis tool written in pure Python with no external dependencies, specifically tuned to detect common mistakes made by AI coding assistants. The scanner was run across roughly 3,800 repositories ranging from small pet projects to popular open-source platforms. It identified thousands of potential secrets and misconfigurations, yet manual review reduced the number of genuine leaks to approximately 30 cases, mostly Telegram bot tokens, database credentials, and committed .env files. The project also examined 471 production-grade Telegram bots handling payments and VPN services, uncovering 31 repositories that exposed real credentials either in current code or in Git history. AigisSAST includes 21 detection rules, 193 regression tests, automatic remediation via the fix command, and seamless integration with GitHub Actions. The author deliberately avoided validating any discovered keys to stay within ethical research boundaries.