Software development is a collaborative effort that leverages existing code, which reduces the cost of developing new software. That said, leveraging existing code exposes coders to vulnerabilities, because existing code might contain programming bugs. We study the formation of dependency networks among software repositories, guided by a strategic model of network formation with observable and unobservable heterogeneity. We estimate costs, benefits, and link externalities of a network of 696, 790 directed dependencies between 35, 473 repositories of the Rust programming language using a scalable statistical algorithm. We find evidence of a positive externality exerted on other coders when coders create dependencies. What is more, we show that coders are likely to link to more popular packages of the same and of other software types. We adopt models for the spread of infectious diseases to measure a package's systemicness as the number of downstream packages a vulnerability would affect. Systemicness is highly skewed with the most systemic repository affecting almost 90% of all repositories only two steps away. Finally, we show that protecting only the ten most important repositories reduces vulnerability contagion by nearly 40%.

Social network data are complex and dependent data. At the macro-level, social networks often exhibit clustering in the sense that social networks consist of communities; and at the micro-level, social networks often exhibit complex network features such as transitivity within communities. Modeling real-world social networks requires modeling both the macro- and micro-level, but many existing models focus on one of them while neglecting the other. In recent work, [28] introduced a class of Exponential Random Graph Models (ERGMs) capturing community structure as well as microlevel features within communities. While attractive, existing approaches to estimating ERGMs with community structure are not scalable. We propose here a scalable two-stage strategy to estimate an important class of ERGMs with community structure, which induces transitivity within communities. At the first stage, we use an approximate model, called working model, to estimate the community structure. At the second stage, we use ERGMs with geometrically weighted dyadwise and edgewise shared partner terms to capture refined forms of transitivity within communities. We use simulations to demonstrate the performance of the two-stage strategy in terms of the estimated community structure. In addition, we show that the estimated ERGMs with geometrically weighted dyadwise and edgewise shared partner terms within communities outperform the working model in terms of goodness-of-fit. Last, but not least, we present an application to high-resolution human contact network data.