[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSKZ3kh6TVbssO4di881lBzFFyfv_Nx_WC47TZFzj03s":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":77},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"5f2d9a1d-e8cf-4c49-b2b3-c544f7ceb09a","PEP 829 Makes Python Startup Safer, But Risk Remains","pep-829-makes-python-startup-safer-but-risk-remains-e882a0","Python 3.15’s PEP 829 introduces .start files to replace unsafe startup behavior in .pth files, making automatic code execution more explicit and auditable. But does this change actually prevent malicious packages from executing code? We examine the new mechanism, demonstrate how attackers can manipulate Python’s startup process to bypass its protections, and explore why this improvement still leaves significant software supply chain risks.","Python 3.15 introduces PEP 829, which replaces the insecure .pth files with .start files for startup code execution. While this change aims to make automatic code execution more explicit and auditable, the article demonstrates that attackers can still manipulate Python's startup process to bypass these new protections, leaving significant software supply chain risks unaddressed.","Python 3.15's PEP 829 improves startup security but doesn't fully prevent malicious code execution.","https:\u002F\u002Fcheckmarx.com\u002Fzero-post\u002Fpep-829-makes-python-startup-safer-but-risk-remains\u002F","https:\u002F\u002Fcheckmarx.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fcxzero_2026-10-cxzero-pep-829-changes_image01.webp","2026-10-15T10:01:00+00:00","2026-10-15T16:00:20.365583+00:00",7,[17,20,23,25],{"name":18,"type":19},"Python 3.15","product",{"name":21,"type":22},"PEP 829","technology",{"name":24,"type":22},".pth files",{"name":26,"type":22},".start files","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,40],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[],[18],{"controls":48,"vendors":76},[49],{"slug":50,"name":51,"problem":52,"products":53},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":71,"product_name":72,"url":74,"description":75},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[],{"slug":78,"title":79,"body":80,"framework_refs":81,"framework_notes":90},"pythons-new-startup-files-reduce-but-dont-eliminate-supply-chain-risk","Python's New Startup Files Reduce But Don't Eliminate Supply Chain Risk","PEP 829 in Python 3.15 replaces the historically exploitable `.pth` file mechanism with more explicit `.start` files, reducing one vector for malicious code injection during Python interpreter startup. However, attackers can still manipulate the startup process through alternative means, meaning the underlying supply chain threat is not fully mitigated. This matters because Python is ubiquitous in development pipelines, data science workflows, and production systems — a compromised startup sequence can silently execute attacker-controlled code before any application logic runs. Organizations relying on Python must not assume a language-level improvement eliminates the need for broader supply chain hygiene practices.",[82,83,84,85,86,87,88,89],"NIST SP 800-161 (Supply Chain Risk Management)","NIST SP 800-53 SI-7 (Software, Firmware, and Information Integrity)","NIST SP 800-53 CM-7 (Least Functionality)","CIS Control 2 (Inventory and Control of Software Assets)","CIS Control 16 (Application Software Security)","SLSA Supply Chain Levels for Software Artifacts (Provenance & Integrity)","OWASP A06:2021 – Vulnerable and Outdated Components","NIST SP 800-218 (Secure Software Development Framework – SSDF)",{}]