There are also an increasing number of cases in the last few years of such maintainers moving on, and that infrastructure failing soon after that. The event-stream npm debacle, the left-pad npm debacle, the electron-native-notify npm debacle, the rest-client ruby gem debacle, the strong_password ruby gem debacle...

Single points of failures in underpaid open source maintainers are an amazing security risk to critical infrastructure. "Patching" the labor market of open source to better account for the realities of downstream profits relative to upstream labor efforts, might be at least one way to make the entire ecosystem better for everyone.