PEP 829 Makes Python Startup Safer, But Risk Remains
Python 3.15's PEP 829 improves startup security but doesn't fully prevent malicious code execution.
Run Python 3.15?
Get an email when a reviewed story names Python 3.15, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Python 3.15 introduces PEP 829, which replaces the insecure .pth files with .start files for startup code execution. While this change aims to make automatic code execution more explicit and auditable, the article demonstrates that attackers can still manipulate Python's startup process to bypass these new protections, leaving significant software supply chain risks unaddressed.
The lesson from this incident
Full lessonPEP 829 in Python 3.15 replaces the historically exploitable `.pth` file mechanism with more explicit `.start` files, reducing one vector for malicious code injection during Python interpreter startup. However, attackers can still manipulate the startup process through alternative means, meaning the underlying supply chain threat is not fully mitigated. This matters because Python is ubiquitous in development pipelines, data science workflows, and production systems — a compromised startup sequence can silently execute attacker-controlled code before any application logic runs. Organizations relying on Python must not assume a language-level improvement eliminates the need for broader supply chain hygiene practices.
What helps against this
How we list vendors- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.