A Strategic Model of Software Dependency Networks

Software development is a collaborative effort that leverages existing code, which reduces the cost of developing new software. That said, leveraging existing code exposes coders to vulnerabilities, because existing code might contain programming bugs. We study the formation of dependency networks among software repositories, guided by a strategic model of network formation with observable and unobservable heterogeneity. We estimate costs, benefits, and link externalities of a network of 696, 790 directed dependencies between 35, 473 repositories of the Rust programming language using a scalable statistical algorithm. We find evidence of a positive externality exerted on other coders when coders create dependencies. What is more, we show that coders are likely to link to more popular packages of the same and of other software types. We adopt models for the spread of infectious diseases to measure a package’s systemicness as the number of downstream packages a vulnerability would affect. Systemicness is highly skewed with the most systemic repository affecting almost 90% of all repositories only two steps away. Finally, we show that protecting only the ten most important repositories reduces vulnerability contagion by nearly 40%.