“Sonatype reports that supply chain attacks increased 650% YoY in 2021.”
A million dollars over four years works out to $250,000 a year, about one senior engineer. Shopify runs one of the largest Rails codebases on earth and depends on rubygems.org staying clean. This is cheap insurance dressed as generosity. Every other company shipping Ruby in production is still paying nothing.