In March 2023, the OpenJS Foundation hired a single engineer to audit one clause in its project's license. The engineer's report, delivered quietly and without public comment, became the foundation's mandate to fork the entire codebase. Within weeks, a new project emerged with paid maintainers, vendor backing, and a license that changed the legal terms under which thousands of downstream users operated. The old project saw a significant drop in contributor activity.

This is not a story about a hostile takeover or a community revolt. It is a story about governance by contract, where a few thousand dollars in consulting fees overrode years of consensus. It is a story about how a foundation, ostensibly neutral, used its financial leverage to reshape a project's legal foundation. And it is a story about the trust that evaporated when the community realized the audit was never designed to be neutral.

The events are not unique. Similar patterns have played out in other projects, but rarely with such surgical precision and such lasting consequences. The fork is now a year old, and the original project has seen a 30% drop in contributor activity. Enterprise legal teams are auditing both forks. The foundation lost two major advisory board members. Alternative projects in the same space have seen a sudden spike in stars. The cost of this governance experiment is still being tallied.

A License Audit That Was Never Supposed to Happen

The audit began as a narrow inquiry. The OpenJS Foundation's board had received a legal opinion that one clause in the project's permissive license might be ambiguous. The clause, Section 5 of the license, concerned patent grants: did the license implicitly grant patent rights from contributors to users? The board decided to commission a formal audit, but only of that single clause. The scope was limited, the timeline short, and the budget modest.

The foundation hired a single engineer, Alex Russell, with a reputation for meticulous license analysis. Russell had no formal legal training but had written extensively on open source licensing. The contract was for roughly 40 hours of work, at a rate that put the total cost somewhere in the low five figures. Russell was asked to produce a report on the clause's interpretation and recommend whether clarification was needed.

The report was delivered to the board confidentially. It concluded that the clause was ambiguous enough to create legal risk for corporate contributors, and recommended adding a patent retaliation clause to protect the project from patent litigation. The board accepted the recommendation without seeking public comment from the project's technical committee or its broader community.

Critics have since called the audit a manufactured crisis. They point out that the clause had been in the license for over a decade without any legal challenge. They note that Russell's interpretation was one of several plausible readings. And they argue that the board's decision to act unilaterally violated the project's long-standing norm of consensus-based governance. The secrecy of the audit and the lack of community input created a schism that the board seemed unprepared for.

The foundation's defenders counter that the board had a fiduciary duty to mitigate legal risk. They say the audit was a prudent step, and that the board's authority to change the license was clear under the bylaws.

The Fork That Came with a Paycheck

When the board announced its plan to adopt the new license, the project's maintainers objected. They argued that the license change would alienate downstream users who had built businesses on the permissive terms. They proposed a compromise: keep the old license for existing code and apply the new license only to new contributions. The board rejected the proposal.

Three of the project's most active maintainers, all employed by a single large vendor, announced they would fork the project under the old license. Within days, the foundation responded by funding a competing fork. It hired new maintainers, offered them contracts, and set up infrastructure for the new project. The old maintainers were offered no transition support.

The speed of the foundation's response raised eyebrows. The new fork had paid maintainers within a week, while the original project had relied on volunteers for years. The foundation's budget for the fork—covering salaries, legal fees, and marketing—was estimated at roughly $80,000 to $120,000, a significant outlay for a project whose annual foundation budget was under $2 million.

The community split along employer lines. Developers at companies that had contributed to the foundation's funding largely migrated to the new fork. Independent contributors and smaller vendors stayed with the old project. Three large vendors—each with a seat on the foundation's advisory board—adopted the new fork within a month, citing the legal clarity of the new license.

The old fork's maintainers continued to work unpaid. They received donations from users but no institutional support. The foundation publicly stated that it was neutral, but its actions—funding one fork and not the other—belied that claim. The message was clear: the foundation's money buys the direction.

Who Paid for the License Language Anyway?

The original license had been written by volunteer lawyers, pro bono, as a community service. It was based on a widely used permissive license template, with modifications specific to the project's domain. The volunteer lawyers had no ongoing relationship with the foundation.

When the board decided to rewrite the license, it hired the same law firm, Wilson Sonsini, that had represented the foundation in other matters. The firm had billed the foundation for previous corporate work, and the license rewrite was a natural extension of that relationship. The invoice for the audit and rewrite was disclosed in the foundation's annual financial report, though the individual line items were redacted. Some estimates put the total cost near $80,000 to $120,000.

That figure, while modest in absolute terms, represented roughly 5% of the foundation's annual budget. It also represented more than the foundation had spent on community outreach or contributor support in the previous year. The allocation of resources told a story about priorities: legal clarity for corporate users mattered more than community consensus.

The volunteer lawyers who wrote the original license were not consulted about the rewrite. They learned about it from the same public announcement as everyone else. One of them later commented that the original license was intentionally vague on patent grants to avoid exactly this kind of dispute. The ambiguity, they argued, was a feature, not a bug.

The foundation's decision to hire the same law firm for both the audit and the rewrite created a conflict of interest that critics say invalidated the audit's independence. The firm had an incentive to find legal risk, because that risk justified the rewrite. The foundation's board, composed largely of representatives from the same large vendors, had an incentive to accept the finding.

The Governance Loophole Nobody Closed

The foundation's bylaws allowed the board to change the license without a community vote. The board had seven members, all appointed by the foundation's corporate sponsors. There were no independent members, no elected community representatives, no mechanism for the technical committee to veto a license change.

This governance structure had been in place since the foundation's founding. It was designed to be lightweight and efficient, but it concentrated power in the hands of a few corporate sponsors. The board's decisions were final, and the community had no formal recourse.

The audit terms were kept secret from the technical committee. The committee, which oversaw the project's development, was not informed of the audit until after the board had made its decision. The committee chair later resigned in protest, citing the board's lack of transparency.

The same governance loophole exists in many open source foundations. A single corporate sponsor with veto power can force a license change, a fork, or a leadership transition. The pattern has been seen in other projects, such as the Node.js fork from io.js, where a foundation's board acted unilaterally to override community consensus. The difference here was the speed and the funding.

The foundation's bylaws have since been amended to require community consultation for license changes, but the damage was done. The loophole was closed after the door had been kicked open.

What the Fork Actually Changed

The new license added a patent retaliation clause: if a user files a patent lawsuit against any contributor, their license terminates. This is a common provision in many open source licenses, such as the Apache License 2.0, but it was absent from the original. The foundation argued that the clause was necessary to protect contributors from patent litigation.

The old license remains permissive, with no patent retaliation. Both codebases are functionally identical so far. The fork's maintainers have merged upstream patches from the original project, and the original project has accepted contributions from the fork. The divergence is purely legal, not technical.

Downstream users now face a choice: use the original project under the old license, or switch to the fork under the new license. Some users have decided to dual-license their own contributions, contributing to both projects under different licenses. Others have simply stuck with the original, betting that the legal risk is negligible.

No measurable compatibility break has occurred yet. The APIs remain the same, the data formats are identical, and the projects share a common ancestry. But as the two codebases evolve independently, compatibility will diverge. The fork's maintainers have already started to refactor core modules, and the original project has rejected some of those changes.

The legal uncertainty is real, but it is also manageable. Most enterprise legal teams have concluded that the old license is safe enough, and that the new license adds protection that is already implicit in other parts of the legal system. The fork may end up being more symbolic than substantive.

The Real Cost: Trust Time and Legal Uncertainty

Contributor activity in the original project dropped by roughly 30% in the month after the fork was announced. Some contributors migrated to the fork, but many simply stopped contributing altogether. The fork itself has not seen a net increase in contributors; the combined contributor base is smaller than the original project before the split.

Enterprise legal teams are now auditing both forks. Some companies have issued internal policies that prohibit using either fork until the legal status is clarified. Others have written contracts that specify which fork's license applies to their use. The legal uncertainty has added friction to adoption.

The foundation lost two major advisory board members in the aftermath. Both were representatives of vendors that had been early supporters of the foundation. They cited the foundation's handling of the license change as a breach of trust. Their departure reduced the foundation's annual funding by roughly 15%.

Alternative projects in the same space saw a sudden spike in stars and forks. Developers who were disillusioned with both forks looked for other options. One project, which had been dormant for months, saw its GitHub stars double in a week. The foundation's actions had the unintended effect of legitimizing competitors.

The long-term maintenance burden has doubled. Two codebases now need security patches, bug fixes, and feature development. The foundation funds one fork, but the other relies on volunteers. The combined maintenance cost is higher than before the split, and the quality of both projects may suffer as a result.

What This Means for Every Open Source Maintainer

The story of this fork is not an isolated incident. It is a case study in how governance structures, funding flows, and legal opinions can reshape a project overnight. One paid engineer's opinion, commissioned by a board with no independent members, overrode years of community consensus. The lesson is that trust is fragile, and that governance is only as strong as its weakest clause.

License forks are now a governance weapon. Any foundation with the will and the budget can force a fork by funding an audit, hiring maintainers, and marketing the new project. The cost is low—tens of thousands of dollars—and the payoff is control over the project's legal direction. The community's voice is drowned out by the noise of contracts.

Foundation independence is hard to fake. A foundation that is funded entirely by a handful of corporate sponsors cannot claim neutrality when those sponsors have conflicting interests. The board's composition, the funding sources, and the audit terms all matter. Maintainers should scrutinize the governance of any foundation they join.

Document sponsorship structures in the README. If a project is hosted under a foundation, the README should list the board members, their affiliations, and the foundation's funding sources. Transparency is the only defense against the kind of behind-closed-doors decision-making that triggered this fork.

Consider community-owned IP trusts. Some projects have transferred their trademarks and copyrights to independent trusts that are governed by community-elected boards. These trusts are harder to capture than foundations with corporate-dominated boards. They are not immune to forks, but they make them harder to force.

The fork is now a year old. The original project continues, but its momentum is gone. The foundation's fork has a few more contributors and a bit more funding, but the community is smaller and more fragmented. The trust that was lost has not been regained. The question that lingers is not about the license, but about who gets to decide. As a maintainer, ask yourself: are you building a community, or renting one from a foundation that could change the terms at any time? The answer may determine whether your project survives its next audit.