PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python

Jacob Mahon; Chenxi Hou; Zhihao Yao

doi:10.1109/BigData66926.2025.11401557

PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python

Jacob Mahon
, Chenxi Hou
, Zhihao Yao

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

Python software development heavily relies on thirdparty packages. Direct and transitive dependencies create a labyrinth of software supply chains. While it is convenient to reuse code, vulnerabilities within these dependency chains can propagate through dependencies, potentially affecting downstream packages and applications. PyPI, the official Python package repository, hosts many packages and lacks a comprehensive analysis of the prevalence of vulnerable dependencies. This paper introduces PyPitfall, a quantitative analysis of vulnerable dependencies across the PyPI ecosystem. We analyzed the dependency structures of 378,573 PyPI packages and identified 4,655 packages that explicitly require at least one known-vulnerable version and 141,044 packages that permit vulnerable versions within specified ranges. By characterizing the ecosystem-wide dependency landscape and the security impact of transitive dependencies, we aim to raise awareness of Python software supply chain security.

Original language	English (US)
Title of host publication	Proceedings - 2025 IEEE International Conference on Big Data, BigData 2025
Editors	Cheng-Zhong Xu, Leong Hou U, Xueqi Cheng, Jing Gao, Giuseppe Polese, Hong Mei, Paul Boniol, Michiaki Tatsubori, Chen Zhao, Dawei Zhou, Xiaohua Hu
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	7825-7834
Number of pages	10
Edition	2025
ISBN (Electronic)	9798331594473
DOIs	https://doi.org/10.1109/BigData66926.2025.11401557
State	Published - 2025
Externally published	Yes
Event	2025 IEEE International Conference on Big Data, BigData 2025 - Macau, China Duration: Dec 8 2025 → Dec 11 2025

Conference

Conference	2025 IEEE International Conference on Big Data, BigData 2025
Country/Territory	China
City	Macau
Period	12/8/25 → 12/11/25

All Science Journal Classification (ASJC) codes

Artificial Intelligence
Computer Networks and Communications
Computer Science Applications
Information Systems
Information Systems and Management
Safety, Risk, Reliability and Quality

Keywords

Dependency Analysis
Python
Software Supply Chain

Access to Document

10.1109/BigData66926.2025.11401557

Cite this

Mahon, J., Hou, C., & Yao, Z. (2025). PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python. In C.-Z. Xu, L. H. U, X. Cheng, J. Gao, G. Polese, H. Mei, P. Boniol, M. Tatsubori, C. Zhao, D. Zhou, & X. Hu (Eds.), Proceedings - 2025 IEEE International Conference on Big Data, BigData 2025 (2025 ed., pp. 7825-7834). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/BigData66926.2025.11401557

Mahon, Jacob ; Hou, Chenxi ; Yao, Zhihao. / PyPitfall : Dependency Chaos and Software Supply Chain Vulnerabilities in Python. Proceedings - 2025 IEEE International Conference on Big Data, BigData 2025. editor / Cheng-Zhong Xu ; Leong Hou U ; Xueqi Cheng ; Jing Gao ; Giuseppe Polese ; Hong Mei ; Paul Boniol ; Michiaki Tatsubori ; Chen Zhao ; Dawei Zhou ; Xiaohua Hu. 2025. ed. Institute of Electrical and Electronics Engineers Inc., 2025. pp. 7825-7834

@inproceedings{f1e63eabb2144634b55793b935fae98c,

title = "PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python",

abstract = "Python software development heavily relies on thirdparty packages. Direct and transitive dependencies create a labyrinth of software supply chains. While it is convenient to reuse code, vulnerabilities within these dependency chains can propagate through dependencies, potentially affecting downstream packages and applications. PyPI, the official Python package repository, hosts many packages and lacks a comprehensive analysis of the prevalence of vulnerable dependencies. This paper introduces PyPitfall, a quantitative analysis of vulnerable dependencies across the PyPI ecosystem. We analyzed the dependency structures of 378,573 PyPI packages and identified 4,655 packages that explicitly require at least one known-vulnerable version and 141,044 packages that permit vulnerable versions within specified ranges. By characterizing the ecosystem-wide dependency landscape and the security impact of transitive dependencies, we aim to raise awareness of Python software supply chain security.",

keywords = "Dependency Analysis, Python, Software Supply Chain",

author = "Jacob Mahon and Chenxi Hou and Zhihao Yao",

note = "Publisher Copyright: {\textcopyright} 2025 IEEE.; 2025 IEEE International Conference on Big Data, BigData 2025 ; Conference date: 08-12-2025 Through 11-12-2025",

year = "2025",

doi = "10.1109/BigData66926.2025.11401557",

language = "English (US)",

pages = "7825--7834",

editor = "Cheng-Zhong Xu and U, \{Leong Hou\} and Xueqi Cheng and Jing Gao and Giuseppe Polese and Hong Mei and Paul Boniol and Michiaki Tatsubori and Chen Zhao and Dawei Zhou and Xiaohua Hu",

booktitle = "Proceedings - 2025 IEEE International Conference on Big Data, BigData 2025",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

address = "United States",

edition = "2025",

}

Mahon, J, Hou, C & Yao, Z 2025, PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python. in C-Z Xu, LH U, X Cheng, J Gao, G Polese, H Mei, P Boniol, M Tatsubori, C Zhao, D Zhou & X Hu (eds), Proceedings - 2025 IEEE International Conference on Big Data, BigData 2025. 2025 edn, Institute of Electrical and Electronics Engineers Inc., pp. 7825-7834, 2025 IEEE International Conference on Big Data, BigData 2025, Macau, China, 12/8/25. https://doi.org/10.1109/BigData66926.2025.11401557

PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python. / Mahon, Jacob; Hou, Chenxi; Yao, Zhihao.
Proceedings - 2025 IEEE International Conference on Big Data, BigData 2025. ed. / Cheng-Zhong Xu; Leong Hou U; Xueqi Cheng; Jing Gao; Giuseppe Polese; Hong Mei; Paul Boniol; Michiaki Tatsubori; Chen Zhao; Dawei Zhou; Xiaohua Hu. 2025. ed. Institute of Electrical and Electronics Engineers Inc., 2025. p. 7825-7834.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - PyPitfall

T2 - 2025 IEEE International Conference on Big Data, BigData 2025

AU - Mahon, Jacob

AU - Hou, Chenxi

AU - Yao, Zhihao

PY - 2025

Y1 - 2025

N2 - Python software development heavily relies on thirdparty packages. Direct and transitive dependencies create a labyrinth of software supply chains. While it is convenient to reuse code, vulnerabilities within these dependency chains can propagate through dependencies, potentially affecting downstream packages and applications. PyPI, the official Python package repository, hosts many packages and lacks a comprehensive analysis of the prevalence of vulnerable dependencies. This paper introduces PyPitfall, a quantitative analysis of vulnerable dependencies across the PyPI ecosystem. We analyzed the dependency structures of 378,573 PyPI packages and identified 4,655 packages that explicitly require at least one known-vulnerable version and 141,044 packages that permit vulnerable versions within specified ranges. By characterizing the ecosystem-wide dependency landscape and the security impact of transitive dependencies, we aim to raise awareness of Python software supply chain security.

AB - Python software development heavily relies on thirdparty packages. Direct and transitive dependencies create a labyrinth of software supply chains. While it is convenient to reuse code, vulnerabilities within these dependency chains can propagate through dependencies, potentially affecting downstream packages and applications. PyPI, the official Python package repository, hosts many packages and lacks a comprehensive analysis of the prevalence of vulnerable dependencies. This paper introduces PyPitfall, a quantitative analysis of vulnerable dependencies across the PyPI ecosystem. We analyzed the dependency structures of 378,573 PyPI packages and identified 4,655 packages that explicitly require at least one known-vulnerable version and 141,044 packages that permit vulnerable versions within specified ranges. By characterizing the ecosystem-wide dependency landscape and the security impact of transitive dependencies, we aim to raise awareness of Python software supply chain security.

KW - Dependency Analysis

KW - Python

KW - Software Supply Chain

UR - https://www.scopus.com/pages/publications/105037880660

UR - https://www.scopus.com/pages/publications/105037880660#tab=citedBy

U2 - 10.1109/BigData66926.2025.11401557

DO - 10.1109/BigData66926.2025.11401557

M3 - Conference contribution

AN - SCOPUS:105037880660

SP - 7825

EP - 7834

BT - Proceedings - 2025 IEEE International Conference on Big Data, BigData 2025

A2 - Xu, Cheng-Zhong

A2 - U, Leong Hou

A2 - Cheng, Xueqi

A2 - Gao, Jing

A2 - Polese, Giuseppe

A2 - Mei, Hong

A2 - Boniol, Paul

A2 - Tatsubori, Michiaki

A2 - Zhao, Chen

A2 - Zhou, Dawei

A2 - Hu, Xiaohua

PB - Institute of Electrical and Electronics Engineers Inc.

Y2 - 8 December 2025 through 11 December 2025

ER -

Mahon J, Hou C, Yao Z. PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python. In Xu CZ, U LH, Cheng X, Gao J, Polese G, Mei H, Boniol P, Tatsubori M, Zhao C, Zhou D, Hu X, editors, Proceedings - 2025 IEEE International Conference on Big Data, BigData 2025. 2025 ed. Institute of Electrical and Electronics Engineers Inc. 2025. p. 7825-7834 doi: 10.1109/BigData66926.2025.11401557

PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python

Abstract

Conference

All Science Journal Classification (ASJC) codes

Keywords

Access to Document

Other files and links

Fingerprint

Cite this