safety security
The Source Was Clean. The Bytecode Wasn't
A million-package-artifact study found source-less Python bytecode and runtime behaviors that ordinary source reproduction missed.
Summary
A million-package-artifact study found source-less Python bytecode and runtime behaviors that ordinary source reproduction missed.
Across 1,034,843 collected PyPI artifacts, the study found 7,388 containing bytecode, including 228,578 .pyc files and 28,193 source-less files local to an artifact. Selected decompilers emitted source for nearly all in-scope modern files, but observed and mutated bytecode also triggered exceptions, timeouts and native failures. Fuzzing produced 1,009 stack-deduplicated runtime findings, 261 with potential memory-corruption characteristics; none reproduced from ordinary Python source. The authors distinguish emitted source from verified functional equivalence and focus on the inspection-execution gap.
Why it matters
A million-package-artifact study found source-less Python bytecode and runtime behaviors that ordinary source reproduction missed.
Limits and context
No additional limitation was separately recorded.
Key claims
A million-package-artifact study found source-less Python bytecode and runtime behaviors that ordinary source reproduction missed.
Evidence: source-2026-08-16-005
Sources
- arXiv preprint 2608.12853arXiv · primary research
Corrections
No corrections have been recorded for this story.