Search papers, labs, and topics across Lattice.
This paper introduces PyFEX, a resilient forced-execution engine designed to systematically explore the behavioral space of Python programs to uncover evasive threats targeting the software supply chain. By employing a novel crash recovery mechanism and automated entry identification, PyFEX can bypass traditional analysis limitations, revealing malicious logic hidden in dormant functions and overcoming runtime obfuscation. The effectiveness of PyFEX is demonstrated through PyFEXScan, which identified 212 previously unknown malicious packages on PyPI, highlighting the critical need for robust analysis tools in the evolving Python ecosystem.
PyFEXScan uncovered over 200 previously unknown malicious packages on PyPI, revealing the vulnerabilities in current analysis tools.
The rapid expansion of the Python ecosystem has fueled two distinct but converging threats: adversaries increasingly target the software supply chain via the Python Package Index (PyPI), while also building evasive, cross-platform malicious binaries compiled from source code written in Python. Current program analysis techniques struggle to address this dual threat. Static analysis based tools are often blinded by runtime obfuscation and compiled bytecode, while dynamic analysis based ones are fragile, prone to evasion by environmental guardrails, and often terminates prematurely due to unsatisfied dependencies. To overcome these limitations, we present PyFEX, a resilient forced-execution engine. PyFEX explores a program's behavioral space systematically by forcing execution across all conditional branches to bypass evasion checks. To address the fragility of dynamic execution, it introduces a novel resilient crash recovery mechanism that synthesizes dummy objects to satisfy failed operations at the runtime, allowing analysis to proceed past fatal errors, and employs path merging to mitigate path explosion. PyFEX further incorporates an automated entry identification mechanism that proactively discovers and invokes dormant functions, exposing malicious logic hidden within uncalled APIs. To demonstrate the efficacy of this engine, we built PyFEXScan, a proof-of-concept malware detector built on top of PyFEX. Evaluated against both known malicious PyPI packages and real-world compiled binaries, PyFEX exposes critical behaviors missed by the existing state-of-the-art tools. In a live deployment on PyPI, PyFEXScan discovered 212 previously unknown malicious packages accounting for over 91,648 downloads, underscoring the necessity of resilient, exhaustive analysis for securing the Python ecosystem.