  Open source software ecosystems consist of thousands of interdependent
libraries, which users can combine to great effect. Recent work has pointed out
two kinds of risks in these systems: that technical problems like bugs and
vulnerabilities can spread through dependency links, and that relatively few
developers are responsible for maintaining even the most widely used libraries.
However, a more holistic diagnosis of systemic risk in software ecosystem
should consider how these social and technical sources of risk interact and
amplify one another. Motivated by the observation that the same individuals
maintain several libraries within dependency networks, we present a
methodological framework to measure risk in software ecosystems as a function
of both dependencies and developers. In our models, a library's chance of
failure increases as its developers leave and as its upstream dependencies
fail. We apply our method to data from the Rust ecosystem, highlighting several
systemically important libraries that are overlooked when only considering
technical dependencies. We compare potential interventions, seeking better ways
to deploy limited developer resources with a view to improving overall
ecosystem health and software supply chain resilience.
