Audit: License Scanners Miss OSMF Fees in .NET Packages
A Pennyforge audit found that package registry metadata does not surface Open Source Maintenance Fee terms: Excelsior 6.5.0 shows an empty license expression, while Polly 8.8.0 reports BSD-3-Clause. The fee is only visible when inspecting package contents, and even then in just one of two cases.
- Registry metadata: 0 of 2 packages reveal the OSMF fee
- Full package audit found the fee only in Excelsior
- Excelsior charges when annual revenue reaches $10,000
- Polly asks $20/month from organizations earning $20,000+
Read next
Software