The Library Beneath the Library
core-js is a polyfill library for JavaScript: it backfills modern language features into older environments so that developers can write contemporary code without testing every runtime edge case manually. By early 2023, the package was recording tens of millions of weekly downloads on npm, a figure that places it among the most widely depended-upon pieces of software in the web ecosystem. Bundlers pull it in automatically; many projects carry it without their engineers ever having made a conscious choice to adopt it.
Denis Pushkarev, working under the handle zloirock, has been its sole maintainer since the project's inception. The situation is not unusual in structure — one person sustaining a library that sits beneath a significant fraction of the web — but Pushkarev's response to it was unusual in form.
The Accounting
In February 2023, Pushkarev published a lengthy document on GitHub laying out, in detail, the economics of maintaining core-js. The post catalogued the download numbers, identified the corporations whose products depend on the library, described the volume of unpaid support labour the project demands, and stated plainly what the financial return had been. GitHub Sponsors, Open Collective, and direct donations together had not produced income sufficient to treat the work as employment. The gap between the library's industrial reach and the money flowing back to its author was not an inference; Pushkarev made it a set of figures.
The post also described personal circumstances: a period of imprisonment in Russia following a 2020 road accident had interrupted the project, and Pushkarev returned to maintenance afterward in financial difficulty. That context made the economics harder to dismiss as abstract. The document is, in the record of maintainer burnout and underfunding, one of the more complete first-person accounts available — not because its circumstances are the worst, but because the author was precise about the numbers.
The reaction followed a familiar pattern. The post circulated widely in developer communities, generated commentary, and produced a short-term spike in sponsorships. Whether that spike persisted is less clear; short-term attention is the characteristic response to published distress in open-source funding, and it rarely converts to stable, recurring income at the level the project's industrial adoption would warrant.
What the Numbers Represent
The core-js situation illustrates a structural problem rather than an individual one. A library that is downloaded a quarter of a billion times weekly is, by any reasonable measure, critical infrastructure. The companies and developers consuming it receive a real economic benefit: they do not have to write or maintain the compatibility layer themselves. The question of who pays for that layer, and on what terms, is not answered by the licence — core-js is distributed under the MIT licence, which imposes no obligation on downstream users to fund development.
Platforms such as GitHub Sponsors and Open Collective exist precisely to channel voluntary contributions back to maintainers, and Pushkarev used both. The problem is not the absence of mechanism but the absence of obligation and, in many organisations, the absence of process: procurement teams that scrutinise commercial software licences often have no corresponding review for unmaintained or underfunded open-source dependencies. The SBOM requirement introduced by US Executive Order 14028 begins to address visibility, but visibility is not funding.
What Pushkarev did in February 2023 was convert a structural problem into a document. The library's adoption figures, the maintainer's income, and the gap between them are now a matter of public record rather than inference. That the gap exists is not surprising; that someone stated it precisely, in public, with numbers, remains uncommon enough to be notable. The post stands as a reference point for any discussion of how the web's dependency graph is actually paid for — which is to say, in most cases, it is not.