99K Android apps mapped to 246 SDKs in new open dataset
334,719 app versions analyzed to expose hidden third-party dependencies across the Android ecosystem.
A team led by Aurora Gori Savellini at IMT School for Advanced Studies Lucca has published a comprehensive dataset that maps Android applications to their third-party Software Development Kit (SDK) dependencies. The dataset was constructed by downloading APK files and metadata from the AndroZoo repository and applying code-level signature matching using detection rules from Exodus Privacy. This static-analysis pipeline identified 246 unique SDKs across 334,719 app-version observations, covering 99,722 distinct apps. Each entry includes app-level metadata (categories, ratings, download counts, review comments) and SDK-level metadata (categories, code roots, version numbers).
Crucially, the researchers mapped SDKs back to their parent companies, allowing for provider-level analysis of technological concentration and upstream control in the mobile ecosystem. This makes the dataset a powerful tool for studying privacy risks, data-collection capabilities, and dependency networks. The entire pipeline and dataset are publicly available on GitHub and Zenodo, enabling reproducible research and future extensions. For professionals in mobile security, privacy, and software engineering, this resource provides a transparent, large-scale view of the often-hidden layer of third-party components that power modern Android apps.
- Dataset contains 334,719 app-version observations from 99,722 unique Android apps.
- Detection of 246 third-party SDKs using Exodus Privacy rules and static analysis on APKs from AndroZoo.
- SDKs are mapped to parent companies, enabling analysis of technological concentration and privacy infrastructure.
Why It Matters
Gives researchers and developers a transparent, reproducible dataset to audit Android privacy risks and third-party dependency concentration.