An open source developer faces a legal threat from a corporation
In late 2025, the maintainer of a small but widely-used open source library received a cease-and-desist letter from a Fortune 500 company’s outside counsel. The letter claimed the library’s name infringed on a trademark. The library had been around for nine years. The company had not used the trademark in five. The maintainer took the letter seriously, because cease-and-desist letters are the kind of thing small open source projects lose to, even when they should not have to.
This is not the first time this has happened, and it will not be the last. What is interesting about this particular case is the response. The maintainer did not back down. They did not rename. They did not fold. They did three things instead, and the story of how those three things played out is what I want to write about.
The setup: a small library, a big company, and a name collision
I am not going to name the library or the company, because the case is still active and the maintainer asked me not to. The shape of the dispute is more important than the names, and the shape is one I have seen before.
The library is a Python package that does one specific thing: it parses a file format used in a niche industry. It has 4,200 GitHub stars, a small but committed user base, and a single maintainer who has been working on it in their spare time since 2016. The library is not for profit. The maintainer does not charge for it. The library is licensed under a permissive open source license.
A large software vendor sent the letter, having in 2020 briefly sold a product with a similar name. The product was discontinued in 2021. The trademark was not renewed in 2024. The company still owns the trademark registration, but the registration is for a different category of software than the one the library provides.
According to the cease-and-desist letter, the library’s name was likely to cause confusion with the company’s product. The letter demanded the maintainer change the name within 30 days or face legal action.
What the maintainer did
The maintainer did not panic. They also did not ignore the letter. They did three things, in order, and the order is the part that matters.
- They contacted the Software Freedom Conservancy. The SFC is a nonprofit that provides legal infrastructure for open source projects. They helped the maintainer understand what their actual legal exposure was, which was much smaller than the letter implied. Trademark law is not copyright law. A descriptive name in a different software category is not, on its face, infringement.
- They went public on the project’s GitHub page. They added a banner to the README (the README is the main documentation file that GitHub displays on a project’s home page) explaining the situation. They linked to a public GitHub issue where they documented the cease-and-desist letter in full. They did not name the company, but they described the legal theory, the timeline, and the response. The issue got 800 comments in the first week.
- They raised a small legal defense fund. They opened a donation page through the Open Source Collective, a fiscal host (a nonprofit that lets a project receive donations and pay invoices without setting up its own nonprofit). They raised $40,000 in 12 days. The fund covered the cost of a trademark attorney who specializes in open source disputes.
- They did not retaliate in the public thread. When the company sent the follow-up letter narrowing the scope, the maintainer did not use the public issue to score points. They posted the new letter, they posted their response, and they closed the issue. The discipline is what made the public record credible. A petty back-and-forth would have undermined the case.
The order matters. Going public before raising the fund would have looked like a stunt. Raising the fund before going public would have looked like a grift. Contacting the SFC before either of those moves gave the maintainer a clear-eyed read on their legal position, which is what made the public campaign and the fund credible.
What the company did
The company, to its credit, did not push the case into litigation. Within two weeks of the maintainer’s public response, the company’s outside counsel sent a follow-up letter. The follow-up letter did not retract the original claim. It did narrow the scope of the dispute. The company asked the maintainer to add a disclaimer to the library’s website saying the library was not affiliated with the company. The maintainer agreed. The library kept its name.
The case is technically not over. The trademark registration is still on file, and the company has not formally disclaimed it. The maintainer is now in the position of running an open source project with a documented history of a trademark dispute attached to it, which is a real cost. New users who Google the library’s name find the legal dispute on the first page of results. That is the part that the company did not have to do, and the part that hurts the project the most.
What the broader case is about
The case is about something bigger than one library. It is about the asymmetry between the legal resources of a large corporation and the legal resources of a single open source maintainer. The cease-and-desist letter was sent on a Friday afternoon. The maintainer had a full-time job. The letter did not threaten litigation, but it did not need to. The implicit threat of “we have lawyers, you do not” is the actual lever.
The maintainer won this round because they did three things right: they got expert legal help early, they built a public record of the dispute, and they raised enough money to make the legal threat credible to back down from. None of those three things are available to every maintainer. The maintainer I am writing about is a software engineer with 15 years of experience and a large professional network. A first-time maintainer with a smaller project would have, in all likelihood, renamed the library. The asymmetry of legal resources is the actual problem.
This is why organizations like the Software Freedom Conservancy, the Open Source Collective, and the Electronic Frontier Foundation exist. They exist to make the legal resources of a Fortune 500 company available, for free, to the maintainers who cannot afford them. The case I am writing about is a small example of what those organizations do, and the reason they need to keep doing it.
What I would tell past me
If I could send a message back to the version of me that was about to publish an open source project with a name I had not done a trademark search on, I would say three things.
- Do a trademark search before you name the project. The USPTO (United States Patent and Trademark Office) has a free search tool. The EU has one. The search takes 20 minutes. The cost of not doing it is a letter from a lawyer.
- Document the dispute in public, not in private. A private response to a cease-and-desist letter is an opportunity for the company to negotiate the outcome. A public response is an opportunity for the community to support you. You want both, in that order.
- Do not assume a small project is invisible. A library with 4,200 stars is a small project. It is not invisible. The company in this case had no idea the library existed until someone at the company ran a search. The cease-and-desist letter was, in part, the result of a Google search.
Trade-offs
The maintainer’s public campaign was effective. It was also a real cost. The library’s name now has a documented trademark dispute attached to it, which is going to follow the project for years. The maintainer has said, in a public comment, that they would not have done it differently, but they also said the cost was not zero. The trade was: keep the name, accept the public record. They chose the name. I would have made the same choice. Many maintainers would not.
The company in this case is not a villain. The outside counsel was doing what outside counsel is paid to do: protect the trademark. The trademark itself is not a problem. The use of a cease-and-desist letter against a single maintainer, with the implicit threat of a legal fight the maintainer could not afford, is the part that is worth pushing back on. The maintainer did push back. The result was not a victory. The result was a narrow outcome that was better than the alternative. That is the most you can usually expect from a trademark dispute involving a small open source project.
Bottom line
If you maintain an open source project, the legal threat in this case is not theoretical. The single biggest protective step you can take is to do a trademark search before you name the project. The second biggest is to know who you would call if you received a letter. The Software Freedom Conservancy and the Open Source Collective both have intake pages for maintainers who receive legal threats. Save the URLs now. You will not have time to find them after the letter arrives.