core-js is a popular – very popular – Javascript package which is the epitome of the XKCD “one man in Nebraska maintains a package that underpins the whole Internet” phenomenon.

Its history is a somewhat amazing – and rather cautionary – tale about how pride of ownership can blind someone to nearly anything.

Denis Pushkarev created core-js in 2012, as a compact library for polyfills, which allow you to use modern features in later versions of Javascript in earlier browsers.  This enables compatibility for a huge swath of users, and core-js is very widely shipped.  80% of the world’s 1,000 largest web sites use it, according to Pushkarev, which means it drives billions in revenue around the globe.

The personal history of the maintainer is rather tragic.  Pushkarev is originally Russia and moved back there in 2020 in order to reduce his cost of living.  This was ill-timed for obvious reasons.  Even worse, he was involved in a serious traffic accident there in which a woman was killed.  He claims the victim was very drunk and he was not at fault (which may very well be true, though we only have his version of events).

In the USA, unless you were an obviously negligent contributor (e.g., drunk driving, speeding recklessly, etc), you would likely not face any jail time and any civil lawsuit would be paid by your insurance.  In Russia, however, according to Pushkarev, guilt is assumed and in this case it came with a hefty legal settlement and a 10-month sentence in a ghastly Russian slave factory.

And now he can’t leave Russia until he pays a large sum of money.

Unfortunately, Pushkarev receives next to nothing for maintaining core-js, which has been downloaded 9 billion times.  And because he’s in Russia, receiving support is even trickier given economic sanctions.

Side note: this is actually a rather dangerous situation.  You have a developer of a package used by a huge swath of the Internet within arm’s reach of the Russian security service.  What if he was blackmailed or strong-armed (or simply replaced)?  This could be a very easy way to distribute malware.

In 2023, Pushkarev posted a long and dire rant about how lack of funding was threatening the project.

Yet as of 2026, it’s still maintained.  Why?

First, What is a Polyfill?

core-js provides polyfilles, which is JavaScript code that adds features to older browsers that don’t support modern JavaScript.  So for example, if you have this modern Javascript code:

array.includes("foo")

…you’ll run into a problem if the browser is IE11, because IE11 doesn’t support Array.prototype.includes().

A polyfill adds it:

if (!Array.prototype.includes) {
    Array.prototype.includes = function(...) {
        ...
    }
}

Your code now runs on IE11.

Historically, this was incredibly important because browsers were wildly inconsistent and not updated frequently (compared to current times).  As new features were released for later browsers, developers wanted to maintain one codebase.  Just use a polyfill layer and all the browsers you might target are magically compatible.

Are Polyfills Still Relevant?

Yes, but…not as much.  Time has marched on and no one is using IE6 any more.  And more importantly, the way browsers are released has changed.  Chrome, Safari, Firefox, etc. all release constantly.  I know I get regular notifications to restart Chrome and Firefox for updates, and so do you.

Back in 2012, IE was everywhere.  That browser doesn’t even exist anymore, which tells you how different the landscape is.

When core-js started, some kind of compatibility layer was necessary for public-facing web sites.  Today, that compatibility layer need has been reduced to enterprise browsers (supporting ancient apps) and other such niche cases.  The project has shifted from “critical for everyone” toward “critical for people who need compatibility.”

Wait, You Said 80% of the Top 1000 Websites Use It

Well, they ship it at any rate.  Whether they need it is another matter.

It’s one of those cases where tons of packages have it in their build pipeline, and to remove it would requite going back and revisiting configs and regression testing and it’s easier to keep it.

Many of those sites don’t ship the full core-js.  Modern toolchains only inject the fraction of the library they need.

And not to be ad hom, but Pushkarev has a motivation to make usage appear as large as possible.

Think of it this way: a Linux server might have libxml2, but that doesn’t mean that every application, or even most applications, use that library.  core-js in 2026 is probably more about dependency prevalence than runtime necessity.

Please Fund Me

Pushkarev has become rather famous for asking for financial support, and not receiving it.

His argument is: big corporations depend on my work, they make billions, I get almost nothing, and then he implies strongly that this is unjust.  His argument is that you surely don’t want core-js to fail, but unless he gets funding, it might.

But there are some big problems with that argument:

• No one forced Pushkarev to choose the MIT license.
• In fact, no one forced him to create core-js.
• And no one is forcing him to continue maintaining it.

Reading Pushkarev, you get the sense that he just can let it go.  Because if I was in his situation – desperately needing a lot of money, and he also has a wife and child now – I would have dropped it like a hot potato.

Gasp.

Yes, perhaps some things on the Internet would break…and that’s a pity.  But you can’t expect a single person to hold the whole weight of the web on their back.  Nor should a single person take the mindset that what they’re maintaining is an eternal commitment.

To be blunt, no one is entitled to compensation for his FOSS work.  You can’t create something, see it become popular, and then expect money.  If it comes, great.  If it becomes too much for you to manage, then you have the right to step away.  But continuing to soldier on while bemoaning the lack of funding is not a right you have.

After all, open source is volunteering.  Pushkarev states he’s let many employment opportunities pass by because he has to maintain core-js, which takes up many hours of his day.  Even his family begs him to take on some money-generating work.

Why doesn’t he?  Because core-js is his baby, and because so many sites depend on it.  I think he likes the fact that he has the prestige of maintaining a really core piece of Internet infrastructure, and to step away would be to give that up.

I get the idea that he’s created something amazing and many people like it.  But he’s never going to get the financial support he needs.  He can’t expect Fortune 500 companies to run npm fund because they’re never going to.  Nor are they obligated to.

Perhaps the golden age of FOSS is coming to an end, because the weight of maintenance work simply makes it no longer practical.  30 years ago, a FOSS package was something you hacked on and released and if others found it useful, cool.  Today, the world’s largest tech companies use your work for free to drive billions of daily views…that’s really a totally different arrangement.

The asymmetrical nature of this is really astonishing, but it’s not surprising.  Why should Meta, for example, fund your nodejs package?  You’re offering it for free.  If you get hit by a bus, and Meta still really needs that package, they’ll pay for its maintenance.  Just because your package is really popular does not in any way create either a side of a two-way relationship: Meta has no responsibility to pay, and you have no responsibility to maintain.

The Irony of core-js

In the case of core-js, the more successful it became, the less visible it became. It “won” by becoming a transitive dependency buried dozens of layers deep, which meant hundreds of millions of users benefited from it without ever knowing its name. That invisibility made it extraordinarily difficult to build a community of contributors or paying sponsors, even as it became part of the web’s critical infrastructure.

I think the most interesting side of the story is this: core-js didn’t become obsolete because it failed.  It became less central because it succeeded.  Its mission was to let developers use modern JavaScript before browsers supported it, right?  Now browsers mostly do support modern JavaScript.

That’s like antivirus software becoming less important because operating systems became more secure, or gzip proxies becoming less important because HTTP servers learned compression themselves.

In other words:

• 2015: “Every site needs core-js.”
• 2020: “Most sites probably need core-js.”
• 2026: “Some sites absolutely need core-jsm but most don’t.”

That’s progress.

And maybe Pushkarev should now just let it go and focus on his needs.

raindog308

raindog308 is a longtime community LETizen, technical writer, and self-described techno polymath. With deep roots in the *nix world, he has a passion for systems both modern and vintage, ranging from Unix, Perl, Python, and Golang to shell scripting and mainframe-era operating systems like MVS. He’s equally comfortable with relational database systems, having spent years working with Oracle, PostgreSQL, and MySQL.

As an avid user of LowEndBox providers, raindog308 runs an empire of LEBs, from tiny boxes for VPNs, to mid-sized instances for application hosting, and heavyweight servers for data storage and complex databases. He brings both technical rigor and real-world experience to every piece he writes.

Beyond the command line, raindog308 has a life-long love of German Shepherd Dogs, high-quality knives, target shooting, theology, tabletop RPGs, playing guitar, and hiking in deep, quiet forests.

His goal with every article is to help users, from beginners to seasoned sysadmins, get more value, performance, and enjoyment out of their infrastructure.

You can find him daily in the forums at LowEndTalk under the handle @raindog308.