Open source is at its altavista moment. The bar is moving from "does it work" to "does it work, is it patched within 24 hours of a disclosure, does it ship features at the speed of a small team with ten agents behind them, and does it have a trust signal a procurement team can verify in a dashboard". No individual maintainer wins that race. A maintainer with agents does. A maintainer with agents and a small team does easily.
In 1998 there were thousands of search engines. Altavista, lycos, excite, hotbot, infoseek. They all did roughly the same thing. Then google figured out pagerank and within five years the others were memories. Not because they were bad. Because the bar moved and they did not move with it.
Npm has more than three million packages. Most of them are maintained by one person, on a weekend, for free. This worked for twenty years.
It stops working in the next two.
The reason is that an attacker with a free claude code subscription can now scan a long-tail package, find a prototype pollution bug, and write the exploit before the maintainer has finished their coffee. A competitor with the same subscription can fork your library, refactor it, ship a faster version, and write better docs in a weekend. The floor used to be human effort. The floor is now agent effort, and agent effort is cheap, parallel, and tireless.
I think this kills most of open source. Not the idea of it. Just the long tail.
It's package Darwinism. Adapt or get archived.
A small number of packages absorb the gravity. They get hardened, instrumented, fuzzed continuously, patched within hours, released weekly. They have maintainers who have figured out how to point agents at their own codebase and let them do the boring work. Everything else gets quietly deprecated, replaced by an llm-suggested alternative, or absorbed into a larger package that already has the security posture and release cadence to survive.
This sounds dystopian if you read it as fewer people writing open source. I do not think that is what happens. I think more people contribute, but to fewer surfaces. The maintainer of a winning package becomes something closer to a platform operator. They merge agent-generated prs, review agent-found vulnerabilities, accept patches that ship through automated security pipelines, and earn revenue from the enterprises that depend on them. The long tail does not disappear, it gets hoovered up.
The security side and the feature side are the same problem viewed from two angles. Both reward concentration. Both reward the maintainer who has internalised that their job is no longer to write code, it is to direct a swarm of agents that write, audit, and patch the code on their behalf. Both punish the maintainer who treats ai as something happening to other people.
The packages that survive the next two years are the ones whose maintainers stop thinking of themselves as authors and start thinking of themselves as conductors. The rest become tarballs in a github archive somewhere, with a readme that says "looking for a new maintainer" and no one replies.
Open source is not dying. It is concentrating. And the question worth asking, if you maintain something today, is whether you are on the side of the gravity or being pulled toward it.