A Strategic Model of Software Dependency Networks

Modern software development involves collaborative efforts and re-use of existing software packages and libraries, to reduce the cost of developing new software. However, package dependencies expose developers to the risk of contagion from bugs or other vulnerabilities. We study the formation of dependency networks among software packages and libraries, guided by a structural model of network formation with observable and unobservable heterogeneity. We estimate costs, benefits and link externalities of a package maintainer, using a scalable algorithm and data from 1,131,342 dependencies of 17,081 packages of the Rust programming language. We find evidence of a positive externality created by coders on other coders through the creation of dependencies. We also find that homophily and competition motives coexist in the creation of the network