Linux Foundation Report Reveals Why Companies Fork Open Source Projects and Maintain Internal Patches
A recent Linux Foundation Research survey of 567 specialists examines how organizations handle modifications to open source components they depend on. The February report titled ROI for Open Source Software Contribution reveals that companies rarely leave external code untouched once it enters production systems.
Many teams add missing functionality, improve integration with internal systems, or accelerate security fixes that upstream maintainers cannot deliver on schedule. Some of these changes are contributed back, while others remain in long-lived private branches. The study focuses on practical patterns of contribution, forking, and the resulting security and maintenance challenges.
Survey Participants and Methodology
The research was conducted in October and November 2025 among subscribers, participants, and partner communities of the Linux Foundation. After validation, 567 respondents remained. Participants averaged 12 years of open source experience and 14 years in IT overall. Developers, engineers, and architects made up 28% of the sample, while 19% worked in systems administration and infrastructure.
Company sizes varied: 29% from organizations with fewer than 250 employees, 31% from mid-sized firms (250–4,999), and 40% from enterprises with 5,000 or more staff. Fifty-one percent represented IT vendors, 35% came from non-IT businesses, and 14% worked in government, non-profit, or educational institutions.
Contribution Patterns and Forking Practices
Seventy-two percent of organizations that use open source also contribute to it. Contributions extend beyond code to documentation, testing, user support, event organization, and project governance. Technical changes show clear business motivations: organizations most often fix components their products already rely on, yet a substantial share also implement new features.
Common working models include using components unchanged (68%), returning patches upstream (49%), maintaining internal forks (45%), hiring external specialists (28%), and participating in project governance (26%). Many organizations apply different strategies to different components.
Reasons for Internal Forks
Among 238 respondents who answered questions about forking, 54% cited development of proprietary features and 44% mentioned integration with internal systems. Security fixes and regulatory requirements were noted by 37%. Additional drivers included slow or abandoned upstream projects (34%), bug fixes (32%), faster release cycles (29%), quality and stability concerns (28%), performance optimization (25%), and license compatibility (18%).
The average organization maintains 86 internal forks, spending 60 hours on each per release cycle. Larger companies show significantly higher numbers: enterprises with 5,000+ employees average 136 forks and 11,152 total hours per cycle.
Security and Supply-Chain Implications
Internal forks create new vulnerability management challenges. A private security patch may leave the component appearing vulnerable in standard scanners if the public version number is retained. Conversely, a fork may miss subsequent upstream fixes. Proper tracking requires recording the exact upstream commit, the list of internal patches, and an owner responsible for synchronization.
The report also shows the largest gaps between business-critical technologies and actual contributions in programming languages and runtimes (53% critical vs 17% contributing), databases (56% vs 25%), and operating systems (59% vs 29%). Thirty-six percent of respondents reported frequent product delays due to missing features or fixes, rising to 54% among the largest organizations.
Active participation yields measurable benefits: 44% of contributors frequently secure desired features in project roadmaps, 55% receive faster responses on bugs and security issues, and 66% report accelerated product development. The study underscores that sustained engagement with upstream projects reduces long-term technical debt when internal branches would otherwise become permanent, untracked products.
Related articles
CrowdSec Confirms Theft of Source Code from Roughly 300 GitHub Repositories via TanStack Supply Chain Attack
French cybersecurity firm CrowdSec has confirmed that attackers stole source code from approximately 300 GitHub repositories, including around 170 private ones. The breach occurred in May 2026 through a compromised TanStack component that exfiltrated an API key with read access to the private codebase. The stolen material included code for the company's SaaS console, AWS procedures, connectors, and automation tools, while the remaining repositories contained already-public open source code. No customer data, passwords, organization details, tokens, or other secrets were included in the leak, and all potentially affected credentials were immediately rotated. CrowdSec stated that the code is tightly integrated with internal systems and has largely changed over the past four months, reducing its usefulness outside the company's environment. The SaaS service code undergoes regular audits, and the company sees no immediate threat from the exposure while the investigation continues.
Dependency Confusion Attacks Let Attackers Hijack Internal Library Names in Corporate Builds
A widespread supply chain risk allows attackers to publish packages with internal company names on public registries such as npm and PyPI, causing build systems to pull malicious versions instead of internal ones. The attack works because package managers treat multiple registries as a single list and select the highest version number, with no inherent priority for internal sources. Researcher Alex Birsan demonstrated the technique in February 2021 by registering names harvested from open repositories and error messages, successfully injecting packages into builds at Microsoft, Apple, PayPal, Shopify, Netflix, Tesla and Uber. The malicious code executes during installation because setup scripts and lifecycle hooks run with the privileges of the build agent, exposing environment variables, tokens and internal network access. Mitigation requires a single internal proxy repository that never mixes public responses for internal package names, scoped namespaces bound to private registries, lock files with content hashes, and disabling install scripts where possible. The technique remains effective against any organization that lists both internal and public registries in its build configuration.
NEOMSA ESB Release Strengthens Supply Chain Security Through SBOM and Dependency Hardening
Neoflex has released a new version of its NEOMSA ESB integration platform with a primary focus on cleaning up the software bill of materials and eliminating critical and high-severity vulnerabilities. The team automated SBOM generation using CycloneDX, ran SCA scans with Grype and OWASP Dependency-Check, and performed SAST and secret scanning across all build pipelines. Instead of blindly updating to the latest versions, engineers applied minimal fixed versions for each advisory while handling complex cases involving transitive dependencies, locked files, and deprecated build tools. The effort reduced the total package count from 5,872 to 1,683 after migrating the frontend build to Vite in Camel Karavan 4.18. Remaining medium and low findings were tracked in DefectDojo with clear remediation timelines. The changes deliver measurable risk reduction for on-premise deployments in critical infrastructure and financial organizations.
CodeScoring Launches CodeScoring.Save Artifact Repository for Secure Enterprise Development
CodeScoring has introduced its own artifact storage solution called CodeScoring.Save, designed to handle packages, libraries, container images, and other software components used in development. The product targets corporate users of any size seeking a predictable and resilient repository that integrates security checks directly into storage and distribution workflows. Built in Go for modern Kubernetes environments, Save supports multiple package formats including Maven, npm, NuGet, PyPI, Go Modules, Docker/OCI, DEB, and RPM while providing proxy access to external repositories. It features role-based access, auditing, independent scaling of compute and storage layers, and native integration with CodeScoring.OSA to surface vulnerability data inside the repository itself. The company positions Save as a standalone local deployment option that can operate independently or alongside its existing OSA Proxy module to block malicious components at the repository level. Future plans include support for AI models as artifacts, starting with storage and distribution for ecosystems such as Hugging Face, along with certification for Russian secure development requirements.