Key global systems, including those used by the US military, rely on open-source tools often maintained by a single unpaid developer, raising questions about security and oversight.