Document Type
Thesis
Date of Award
5-31-2026
Degree Name
Master of Science in Computer Science - (M.S.)
Department
Computer Science
First Advisor
Zhihao Yao
Second Advisor
Reza Curtmola
Third Advisor
Iulian Neamtiu
Abstract
Python software development heavily relies on third-party packages. Direct and transitive dependencies create a labyrinth of software supply chains. While it is convenient to reuse code, vulnerabilities within these dependency chains can propagate through dependencies, potentially affecting downstream packages and applications. PyPI, the official Python package repository, hosts many packages and lacks a comprehensive analysis of the prevalence of vulnerable dependencies. PyPitfall, a quantitative analysis of vulnerable dependencies across the PyPI ecosystem, is introduced. The dependency metadata of 378,573 PyPI packages is analyzed. 4,655 packages that explicitly require a known vulnerable package version and 141,044 packages that permit a vulnerable version within specified ranges are identified. By characterizing the ecosystem-wide dependency landscape and the security impact of transitive dependencies, awareness of Python software supply chain security is raised.
Recommended Citation
Mahon, Jacob, "PyPitfall: Dependency chaos and supply chain vulnerabilities in Python" (2026). Theses. 3553.
https://digitalcommons.njit.edu/theses/3553
