Census II is a 2022 Linux Foundation, Harvard Laboratory for Innovation Science (LISH), and Open Source Security Foundation (OpenSSF) study of open-source libraries embedded in production applications. It analyzed more than half a million library observations from software-composition-analysis scans at thousands of companies, showing that software supply-chain risk is shaped not only by vulnerabilities, but also by dependency sprawl, legacy versions, naming inconsistencies, and fragile maintainer and account security.
What Census II studied
Census II is the second major census of widely used free and open-source software (FOSS) sponsored by the Linux Foundation. Whereas Census I concentrated on lower-level operating-system libraries and utilities, Census II examined application-level libraries incorporated into production software.
The study was released in March 2022 and was produced with Harvard LISH and OpenSSF. Its purpose was to identify components used at significant scale so that security work, maintenance support, and ecosystem resources could be prioritized. The Linux Foundation described it as “the first to analyze the security risks of open source software used in production applications.”
Its central lesson is not that every popular library is unsafe. Rather, software that many organizations depend on can still have weak visibility, outdated versions, concentrated maintainership, or poorly protected publishing accounts.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow the data was collected—and what it represents
Census II aggregated more than half a million observations of FOSS libraries found in production applications at thousands of companies. The observations came from software-composition-analysis (SCA) scans supplied by Snyk, the Synopsys Cybersecurity Research Center (CyRC), and FOSSA.
#1 Best Overall
An observation is evidence that a library appeared in a scanned production codebase; it is not a count of all installations worldwide. Because the sample came from participating companies and SCA partners, the results describe important patterns in production software but do not measure every organization, project, or package ecosystem.
The study also exposed why simple package lists are inadequate. A single project may appear under different names in different package registries or datasets. It may also pull in transitive dependencies—packages required by another package—and those dependencies can have their own versions, vulnerabilities, and upgrade constraints.
The five findings that matter most
| Finding | What Census II showed | Why it matters |
|---|---|---|
| Names are inconsistent | The same software can be represented by different names across ecosystems and data sources. | Inventory, aggregation, and risk matching can miss or duplicate components. |
| Versions define the risk | A library name alone does not identify the exact code in use; transitive dependencies and upgrade paths also matter. | Remediation requires precise version and dependency information. |
| Maintainers are concentrated | “Much of the most widely used FOSS is developed by only a handful of contributors.” | A small bus factor can create continuity, review, and response risks. |
| Developer accounts are part of the attack surface | Highly deployed packages may be hosted under personal accounts with weaker organizational controls. | Compromise of one publishing or source account can affect many downstream users. |
| Legacy packages remain common | Outdated and unsupported components continue to ship in production. | Known vulnerabilities can remain in systems long after fixes exist. |
1. Component names need standardization
Dependency records are only useful when they identify the same component consistently. Naming differences between package ecosystems, scanners, and internal inventories can prevent teams from joining usage data to vulnerability advisories or support information.
Recommended Free Tools
Organizations should normalize package identifiers as part of inventory management, while preserving the ecosystem in which each package was found. A name without its registry context can be ambiguous.
2. A package name is not enough
Security and maintenance decisions depend on the exact version, not merely on whether a project appears in an application. Teams must capture direct dependencies, transitive dependencies, and the relationships that determine whether an upgrade is safe or practical.
This is why an inventory that says “logging library” or lists only top-level packages cannot reliably answer which code is running or whether a fix has reached every affected application.
3. Popular projects can have a small bus factor
Census II found that much of the most widely used FOSS is developed by only a handful of contributors. Heavy adoption therefore does not guarantee a large engineering organization, formal release process, or succession plan.
Contributor concentration should be treated as a supply-chain continuity signal, not as proof that a project is insecure. A small team may maintain excellent software, but organizations that depend on it should understand who reviews changes, responds to vulnerabilities, and can continue the project if a key maintainer becomes unavailable.
Rank #3
- Used Book in Good Condition
4. Individual accounts can protect—or endanger—the ecosystem
A widely deployed package may be published or maintained through a personal developer account. If that account lacks multifactor authentication, separation of duties, recovery procedures, or least-privilege controls, an attacker may be able to distribute a malicious release or alter source code used downstream.
Account security therefore belongs in dependency-risk assessments alongside code vulnerabilities. Projects and organizations can reduce exposure by using organizational ownership where possible, enforcing multifactor authentication, limiting publishing privileges, and monitoring repository and package-registry activity.
5. Legacy software remains in production
The Linux Foundation’s summary reported that Apache log4j 1.x was ten times more prevalent than log4j 2.x in the observed data. Log4j 1.x had been end-of-life since 2015 and carried known unpatched vulnerabilities, yet it remained widely deployed.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The example illustrates why “a newer major version exists” is not the same as “production systems have upgraded.” Compatibility concerns, neglected applications, and transitive dependencies can keep unsupported code in service for years.
Why outdated dependencies are dangerous
An end-of-life package no longer receives normal upstream fixes. If a vulnerability is discovered after support ends, users may have no official patch and may need to migrate, isolate the affected component, or maintain a private fix.
Old dependencies also create uncertainty: teams may not know which applications contain them, whether a vulnerable code path is reachable, or which upgrades will break APIs. The longer an unsupported package remains in production, the more difficult and expensive remediation generally becomes.
The log4j 1.x observation is a prevalence finding, not a claim that every application using it was compromised. It demonstrates that deployment scale and security support can diverge sharply.
What organizations should do with the findings
- Build an authoritative inventory. Collect dependencies from production builds and runtime applications, not only from manually maintained spreadsheets.
- Normalize component identities. Map package names to consistent identifiers while retaining registry and ecosystem information.
- Record exact versions. Include direct and transitive dependencies, resolved versions, and the applications in which each appears.
- Detect vulnerability and support status. Use SCA or equivalent analysis to identify known vulnerabilities, end-of-life releases, and available upgrade paths.
- Prioritize by exposure and maintainership. Give extra attention to components that combine widespread deployment with a very small contributor group or weak project governance.
- Secure publishing and source accounts. Require multifactor authentication, organizational ownership where practical, least privilege, protected release workflows, and access monitoring.
- Plan remediation before an emergency. Test upgrades, document exceptions, assign owners, and define deadlines for unsupported components.
How SCA and SBOM practices fit in
SCA tools help discover components and match them against vulnerability and lifecycle data. A software bill of materials (SBOM) provides a portable record of those components for handoffs between development, security, operations, and customers. Neither approach removes the need for engineering judgment: inventories still need accurate identifiers, resolved versions, and context about how a dependency is used.
Best Value
When evaluating a dependency-security platform, assess:
- coverage of the package ecosystems your organization uses;
- resolution of versions and transitive dependencies;
- vulnerability and end-of-life detection;
- SBOM import and export;
- maintainer and project-health signals;
- remediation workflow and upgrade guidance;
- repository and package-publishing account controls;
- deployment model and data handling; and
- cost, support, and ownership of the resulting data.
Snyk, FOSSA, and Synopsys are examples of SCA providers whose scan data contributed to Census II. Their participation identifies the study’s data sources; it is not a comparative product ranking.
What Census II cannot tell you
- It does not enumerate every open-source project or every company using FOSS.
- It does not prove that a highly used library is insecure.
- It does not show that contributor count alone predicts a project’s failure.
- It does not replace a current inventory of your own applications and resolved dependencies.
- It is a March 2022 measurement, so current package usage, support status, and vendor capabilities require up-to-date verification.
Used within those limits, Census II is a prioritization map: it highlights where visibility, patching, maintainer support, and account security deserve the most attention.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
A practical review checklist
- Can you identify every production component by ecosystem, name, and exact version?
- Can you trace each transitive dependency to the application that brought it in?
- Do your tools flag both vulnerabilities and end-of-life releases?
- Are high-impact projects dependent on one person or a very small team?
- Are source-control and package-publishing accounts protected with multifactor authentication and least privilege?
- Do application owners have tested upgrade paths for unsupported libraries?
- Can you export an SBOM and provide it to incident responders or customers?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
