The Digester

Maven Central and other open source package registries say a tiny share of IPs creates the bulk of traffic, prompting proposals to keep downloads free for individual developers while charging commercial-scale users to cover growing infrastructure and security costs.

Maven and other registries reported 10 trillion downloads last year, driven by CI pipelines, security scanners, and AI tooling.
82 percent of Maven Central consumption comes from less than 1 percent of worldwide IPs, with about 80 percent of traffic from the three major hyperscalers.
Some organizations and misconfigured builds repeatedly download the same artifacts millions of times, creating unsustainable load and costs.
Registries and OpenSSF issued an open letter in September 2025 calling for mandatory tiered access models to keep hobbyist use free while charging high-volume commercial users.
Changes are expected to roll out next quarter as projects seek funding for bandwidth, storage, security, and regulatory compliance.

Registries consider tiered fees after under 1 percent of IPs generate 82 percent of downloads

Sources