  In finance, leverage is the ratio between assets borrowed from others and
one's own assets. A matching situation is present in software: by using free
open-source software (FOSS) libraries a developer leverages on other people's
code to multiply the offered functionalities with a much smaller own codebase.
In finance as in software, leverage magnifies profits when returns from
borrowing exceed costs of integration, but it may also magnify losses, in
particular in the presence of security vulnerabilities. We aim to understand
the level of technical leverage in the FOSS ecosystem and whether it can be a
potential source of security vulnerabilities. Also, we introduce two metrics
change distance and change direction to capture the amount and the evolution of
the dependency on third-party libraries.
  The application of the proposed metrics on 8494 distinct library versions
from the FOSS Maven-based Java libraries shows that small and medium libraries
(less than 100KLoC) have disproportionately more leverage on FOSS dependencies
in comparison to large libraries. We show that leverage pays off as leveraged
libraries only add a 4% delay in the time interval between library releases
while providing four times more code than their own. However, libraries with
such leverage (i.e., 75% of libraries in our sample) also have 1.6 higher odds
of being vulnerable in comparison to the libraries with lower leverage.
  We provide an online demo for computing the proposed metrics for real-world
software libraries available under the following URL: https://techleverage.eu/.
