Beyond Source: An Empirical Study of Python Bytecode Security Risks

• URL: http://arxiv.org/abs/2608.12853v1
• Date: Thu, 13 Aug 2026 05:54:24 GMT
• Title: Beyond Source: An Empirical Study of Python Bytecode Security Risks
• Abstract summary: Python runtimes can execute bytecode directly through.pyc files, compiled-only modules, and marshalled code objects.<n>Across 1,034,843 collected PyPI artifacts, we identify 7,388 bytecode-containing artifacts, including 228,578.pyc files and 28,193 artifact-local source-less.pyc files.
• Score: 9.295635962179816
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Python package security is largely source-centric, yet Python runtimes can execute bytecode directly through .pyc files, compiled-only modules, and marshalled code objects, creating an inspection-execution gap. We present an empirical study of Python bytecode as a security artifact. We measure bytecode exposure in PyPI distributions, evaluate practical analyzability using version-aware tooling, assess CPython runtime robustness under adversarial bytecode, and test source-level reproduction of bytecode findings. Across 1,034,843 collected PyPI artifacts, we identify 7,388 bytecode-containing artifacts, including 228,578 .pyc files and 28,193 artifact-local source-less .pyc files. For modern CPython 3.8-3.14 bytecode, at least one selected decompiler emits source for 204,901 of 204,904 in-scope files, a result measuring emission rather than verified functional equivalence. Tools are non-robust: observed PyPI bytecode triggers managed-code exceptions and timeouts, while adversarial mutated bytecode also drives decompilers into native process failures; together these outcomes yield 17 distinct robustness signatures. Fuzzing produces 1,009 stack-deduplicated runtime findings dominated by pointer-dereference symptoms; 261 groups exhibit potential memory-corruption characteristics, and at least 91.7% of groups reach execution beyond the documented-unsafe ingestion boundary. None reproduce from ordinary Python source. Bytecode is thus a visible ecosystem artifact, a practical analysis target, and a security-relevant interpreter input whose behavior need not match source-level behavior.

Related papers

• PyFEX: Uncovering Evasive Python-based Threats via Resilient and Exhaustive Path Exploration [12.933997903334282]
  We present PyFEX, a resilient forced-execution engine for program analysis.<n> PyFEX explores a program's behavioral space systematically by forcing execution across all conditional branches to bypass evasion checks.<n>To demonstrate the efficacy of this engine, we built PyFEXScan, a proof-of-concept malware detector built on top of PyFEX.
  arXiv  Detail & Related papers  (2026-06-01T12:51:21Z)
• Cross-Ecosystem Vulnerability Analysis for Python Applications [8.776396282382864]
  Python applications depend on native libraries that may be vendored within package distributions or installed on the host system.<n>Current vulnerability scanners produce false negatives by missing vendored vulnerabilities and false positives by ignoring security patches backported by OS distributions.<n>We present a provenance-aware vulnerability analysis approach that resolves vendored libraries to specific OS package versions or upstream releases.
  arXiv  Detail & Related papers  (2026-03-19T09:52:29Z)
• Real-World Fault Detection for C-Extended Python Projects with Automated Unit Test Generation [14.579734219257224]
  Python libraries use C-extensions for performance-critical operations.<n>Exceptions raised in C can bypass Python's exception handling and cause the entire interpreter to crash.<n>We propose separating the generation and execution stages of the test-generation process.
  arXiv  Detail & Related papers  (2026-03-06T10:05:29Z)
• One Detector Fits All: Robust and Adaptive Detection of Malicious Packages from PyPI to Enterprises [10.03632278118504]
  We introduce a robust detector capable of seamless integration into both public repositories like PyPI and enterprise ecosystems.<n>To ensure robustness, we propose a novel methodology for generating adversarial packages using fine-grained code obfuscation.<n>Our detector can be seamlessly integrated into both public repositories like PyPI and enterprise ecosystems, ensuring a very low time budget of a few minutes to review the false positives.
  arXiv  Detail & Related papers  (2025-12-03T23:53:56Z)
• Decompiling Smart Contracts with a Large Language Model [51.49197239479266]
  Despite Etherscan's 78,047,845 smart contracts deployed on (as of May 26, 2025), a mere 767,520 ( 1%) are open source.<n>This opacity necessitates the automated semantic analysis of on-chain smart contract bytecode.<n>We introduce a pioneering decompilation pipeline that transforms bytecode into human-readable and semantically faithful Solidity code.
  arXiv  Detail & Related papers  (2025-06-24T13:42:59Z)
• PyPulse: A Python Library for Biosignal Imputation [58.35269251730328]
  We introduce PyPulse, a Python package for imputation of biosignals in both clinical and wearable sensor settings.<n>PyPulse's framework provides a modular and extendable framework with high ease-of-use for a broad userbase, including non-machine-learning bioresearchers.<n>We released PyPulse under the MIT License on Github and PyPI.
  arXiv  Detail & Related papers  (2024-12-09T11:00:55Z)
• depyf: Open the Opaque Box of PyTorch Compiler for Machine Learning Researchers [92.13613958373628]
  textttdepyf is a tool designed to demystify the inner workings of the PyTorch compiler. textttdepyf decompiles bytecode generated by PyTorch back into equivalent source code.
  arXiv  Detail & Related papers  (2024-03-14T16:17:14Z)
• Causal-learn: Causal Discovery in Python [53.17423883919072]
  Causal discovery aims at revealing causal relations from observational data. $textitcausal-learn$ is an open-source Python library for causal discovery.
  arXiv  Detail & Related papers  (2023-07-31T05:00:35Z)
• DADApy: Distance-based Analysis of DAta-manifolds in Python [51.37841707191944]
  DADApy is a python software package for analysing and characterising high-dimensional data. It provides methods for estimating the intrinsic dimension and the probability density, for performing density-based clustering and for comparing different distance metrics.
  arXiv  Detail & Related papers  (2022-05-04T08:41:59Z)
• PyGOD: A Python Library for Graph Outlier Detection [56.33769221859135]
  PyGOD is an open-source library for detecting outliers in graph data. It supports a wide array of leading graph-based methods for outlier detection. PyGOD is released under a BSD 2-Clause license at https://pygod.org and at the Python Package Index (PyPI)
  arXiv  Detail & Related papers  (2022-04-26T06:15:21Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.