The OSMF Visibility Gap: Your License Scanner Can’t See the Fee

Description and use

Automated license scanners miss hidden Open Source Maintenance Fees that are only present in package contents, not registry metadata.

Problem

Automated license scanners miss Open Source Maintenance Fee (OSMF) terms that are only present in package contents, not registry metadata.

Outcome

Registry‑only scans miss OSMF fees; full package audits catch only one of two adopters, revealing a 0/2 registry visibility and 1/2 package visibility gap.

Workflow

• Query NuGet V3 registration API for licenseExpression, licenseUrl, tags, description.
• Download the latest .nupkg from NuGet flat container.
• Inspect package contents for OsmfEula.txt or fee references.
• Compare registry metadata across versions (e.g., Excelsior 4.0.0 vs 5.0.0).

Evidence

For each confirmed adopter we asked two questions, each at a different depth: 1) Registry‑only audit – what does the package registry's metadata say? 2) Full package audit – download the latest nupkg, list every file, grep for fee/OSMF/sponsor/EULA signals.

Source

Excelsior 6.5.0 – Fee in registry metadata? NO – licenseExpression = "" (empty), licenseUrl = the deprecated placeholder aka.ms/deprecateLicenseUrl, no OSMF in tags/description.

Source

Excelsior 6.5.0 – Fee in package contents? YES – OsmfEula.txt shipped in the package; nuspec declares <license type="file">OsmfEula.txt</license> + requireLicenseAcceptance=true + SponsorCheck buildTransitive files.

Source

Polly 8.8.0 – Fee in registry metadata? NO – actively misleading: licenseExpression = "BSD-3-Clause".

Source

Polly 8.8.0 – Fee in package contents? NO – 20 files, zero mentions of fee/OSMF/sponsor.

Source

Score: registry-level visibility 0/2 (0%); full-package visibility 1/2 (50%).

Source