OpenSSF Community Day Europe 2026

On 8 Sept 2025, one phishing email hijacked a maintainer's npm account and pushed malicious versions of chalk, debug and 16 other packages totalling 2.6B weekly downloads. When such a package breaks something that hurts someone, who pays?
Two EU laws finalised in 2024 shape the answer, the Product Liability Directive and the Cyber Resilience Act, and their duties phase in across 2026 and 2027. So we go hands-on: we take this real compromise and walk it, step by step, down the liability chain. The maintainer, it turns out, is the one the law works hardest to shield as non-commercial open source sits largely outside both regimes. The bill lands downstream, on the commercial manufacturer who ships debug inside a product. Under the PLD, a missing security update can itself be a defect, under strict liability. The CRA adds a second layer since it lays a duty on to manage exactly this kind of vulnerability - detect it, report it, patch it - backed by fines, while the "open-source steward" carries a lighter, fine-free load.