Search papers, labs, and topics across Lattice.
This study investigates the security implications of Python bytecode, revealing significant vulnerabilities in the execution of bytecode artifacts from the PyPI repository. By analyzing over a million artifacts, the authors identify thousands of bytecode-containing files and demonstrate that common decompilers struggle with robustness, often leading to exceptions and failures when processing adversarial bytecode. The findings highlight that bytecode can behave unpredictably compared to its source code, underscoring the need for enhanced security measures in Python package management.
Python bytecode is a ticking time bomb in package security, with over 7,000 artifacts exposing vulnerabilities that traditional source-centric approaches overlook.
Python package security is largely source-centric, yet Python runtimes can execute bytecode directly through .pyc files, compiled-only modules, and marshalled code objects, creating an inspection-execution gap. We present an empirical study of Python bytecode as a security artifact. We measure bytecode exposure in PyPI distributions, evaluate practical analyzability using version-aware tooling, assess CPython runtime robustness under adversarial bytecode, and test source-level reproduction of bytecode findings. Across 1,034,843 collected PyPI artifacts, we identify 7,388 bytecode-containing artifacts, including 228,578 .pyc files and 28,193 artifact-local source-less .pyc files. For modern CPython 3.8-3.14 bytecode, at least one selected decompiler emits source for 204,901 of 204,904 in-scope files, a result measuring emission rather than verified functional equivalence. Tools are non-robust: observed PyPI bytecode triggers managed-code exceptions and timeouts, while adversarial mutated bytecode also drives decompilers into native process failures; together these outcomes yield 17 distinct robustness signatures. Fuzzing produces 1,009 stack-deduplicated runtime findings dominated by pointer-dereference symptoms; 261 groups exhibit potential memory-corruption characteristics, and at least 91.7% of groups reach execution beyond the documented-unsafe ingestion boundary. None reproduce from ordinary Python source. Bytecode is thus a visible ecosystem artifact, a practical analysis target, and a security-relevant interpreter input whose behavior need not match source-level behavior.
