The Bernie Foundation

What's a Bernie?

A Bernie is an open source package that's still being downloaded millions of times a week, still resolving in your lockfile, still passing CI — but nobody is home. The maintainer has moved on. Issues pile up. PRs go unreviewed. The package is, for all practical purposes, dead… it just hasn't stopped moving yet.

Like the 1989 movie, the ecosystem keeps propping these packages up and parading them around as if everything is fine. It isn't.

Why this is a supply chain problem

Unmaintained code used to be low-risk simply because nobody bothered to look at it. That era is over. Automated and AI-assisted vulnerability discovery means real, exploitable bugs are now being found in code that has no one to fix it.

• CVEs with nowhere to go A valid vulnerability is reported, but there's no maintainer to receive it and no fixed version to upgrade to.
• Frozen registry namespaces One absent individual holds publish rights. Even if a patch exists, it never reaches npm install or pip install.
• Transitive version pins A dead package's strict version constraints block your other dependencies from taking security updates.
• Silent, unexamined code Millions of dependents, zero recent eyeballs. The bugs are there — they just haven't been filed yet.

Our mission

The Bernie Foundation exists to fund and perform the ongoing engineering work that keeps unmaintained dependencies from becoming supply chain incidents.

Most organizations treat their dependency tree the way bad owners treat a puppy: they loved bringing it home, but nobody wants to walk it. We are the people who show up to do the unglamorous work — triage, patching, coordination with registries, and responsible handoff — so that a dead package doesn't become your breach notification.

How we work: Fix, Fork, Forgo

For every Bernie we identify in the critical dependency graph, we apply one of three engineering strategies.

• Fix Patch the vulnerability upstream, get it merged, and get a release cut — even if that means doing the release engineering ourselves.
• Fork When upstream is truly gone, publish a maintained, minimal-diff fork under foundation stewardship and coordinate registry handover.
• Forgo Help the ecosystem migrate off dependencies that no longer justify their risk, with codemods and clear deprecation paths.

Funding: the 4th F

Funding is rarely straightforward. Donating money to maintainers is obviously helpful, but it does not automatically produce the secure outcomes we need.

The reality is that many open source projects are maintained by people who have day jobs and real-life responsibilities. Their maintenance work takes up what other people would think of as free time. Asking them to do more — even paying them to do more — can actually make things worse.

Organizations like Alpha-Omega direct funding in leveraged and strategic ways to catalyze improvements in open source security and sustainability. The Bernie Foundation works alongside efforts like these, putting engineering hands on the keyboard where money alone can't.