Imagine you're building a house and you need a fancy doorknob. You could order it from a supplier — then if the supplier issues a recall, you know exactly which house has the defective part. Or, you could sneak into a neighbor's house, photocopy their doorknob, and install the copy. Now nobody knows where that doorknob came from, whether it's been updated, or if it has a known safety flaw.

That second scenario is exactly what happens constantly in open-source software, and this paper is the first large-scale attempt to measure how bad the problem is.

What they did: The authors used World of Code, a massive dataset that indexes essentially the entire open-source ecosystem, to hunt for individual source files that appear in multiple repositories. Not packages pulled in via npm or pip — those are tracked, versioned, and scannable. They looked for the invisible cousin: developers copy-pasting a single file from Project A into Project B, sometimes with attribution, often without.

What they found: File-level copying is enormous and mostly untracked. When you install a package via a package manager, you get four things for free:

• Provenance — you know where it came from
• Maintenance — you get updates when the author fixes bugs
• Security — vulnerability scanners can flag known CVEs
• Compliance — license obligations are visible

Copy a file directly, and all four signals vanish. The copied file becomes a silent, orphaned fork. If the original author patches a critical security bug next week, your copy never hears about it. If the original is GPL-licensed and you shipped it in a proprietary product, you've quietly created a legal problem. If a supply-chain attacker slips malicious code into a popular utility file, downstream copies inherit the malware with no way to trace it.

The key insight: The security community obsesses over declared dependencies — the package.json and requirements.txt we can scan. But there's a whole parallel dependency graph made of copy-paste that nobody is tracking. Every "borrowed" utility file, every StackOverflow-lifted helper, every vendored snippet is a dependency in practice but invisible in tooling.

The authors argue this deserves the same treatment as packaged dependencies: tools that detect copied files, restore the missing provenance signal, and let security scanners and license auditors work on the "shadow" dependency graph too.