  Open-source software (OSS) supply chain security has become a topic of
concern for organizations. Patching an OSS vulnerability can require updating
other dependent software products in addition to the original package. However,
the landscape of OSS dependencies is not well explored: we do not know what
packages are most critical to patch, hindering efforts to improve OSS security
where it is most needed. There is thus a need to understand OSS usage in major
software and device makers' products. Our work takes a first step toward
closing this knowledge gap. We investigate published OSS dependency information
for 108 major software and device makers, cataloging how available and how
detailed this information is and identifying the OSS packages that appear the
most frequently in our data.
