If I was getting spam from devs to fix a thing in a library like this, my response would be "sure, here's my rate $/h". This seems like a pretty fair put up or

If I was getting spam from devs to fix a thing in a library like this, my response would be "sure, here's my rate $/h". This seems like a pretty fair put up or shut up response. The underlying issue here is that there are many libraries that a supported by solo devs like this. An idea I just had is that it would be reasonable to calculate a risk metric for every package in the various eco-systems that takes repo maintainer count (and other things) into consideration. Publishing this metric into the package metadata / package page on npmjs would probably gamify not having single points of failure in widely used libraries, and make it clear when this is happening at some point in your dependency chain (averting a future left-pad style debacle).