[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGmXd4qMMjbG_opVmdn43YQuILlOwWfKJBhThJNrV59U":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":47,"controls":48},"864cbcd9-95ab-4ed7-8156-c343bcdc2d02","pythons-new-startup-files-reduce-but-dont-eliminate-supply-chain-risk","5f2d9a1d-e8cf-4c49-b2b3-c544f7ceb09a","Python's New Startup Files Reduce But Don't Eliminate Supply Chain Risk","PEP 829 in Python 3.15 replaces the historically exploitable `.pth` file mechanism with more explicit `.start` files, reducing one vector for malicious code injection during Python interpreter startup. However, attackers can still manipulate the startup process through alternative means, meaning the underlying supply chain threat is not fully mitigated. This matters because Python is ubiquitous in development pipelines, data science workflows, and production systems — a compromised startup sequence can silently execute attacker-controlled code before any application logic runs. Organizations relying on Python must not assume a language-level improvement eliminates the need for broader supply chain hygiene practices.","**Immediate actions:**\n- Audit all existing `.pth` files in Python environments and remove or validate any that are not explicitly required.\n- Pin Python and third-party package versions in all production and CI\u002FCD environments to prevent unexpected dependency substitution.\n\n**Long-term improvements:**\n- Implement software composition analysis (SCA) tools in CI\u002FCD pipelines to detect malicious or unexpected packages before deployment.\n- Enforce least-privilege principles for Python runtime environments so startup code cannot access sensitive resources or credentials.\n- Maintain a curated, internal package mirror and prohibit direct installs from public repositories without review.\n\n**Detection measures:**\n- Enable runtime integrity monitoring to alert on unexpected files introduced into Python's `site-packages` or startup directories.\n- Log and review all package installation events across developer workstations, build servers, and production hosts for anomalous activity.",[12,13,14,15,16,17,18,19],"NIST SP 800-161 (Supply Chain Risk Management)","NIST SP 800-53 SI-7 (Software, Firmware, and Information Integrity)","NIST SP 800-53 CM-7 (Least Functionality)","CIS Control 2 (Inventory and Control of Software Assets)","CIS Control 16 (Application Software Security)","SLSA Supply Chain Levels for Software Artifacts (Provenance & Integrity)","OWASP A06:2021 – Vulnerable and Outdated Components","NIST SP 800-218 (Secure Software Development Framework – SSDF)",{},"published","2026-10-15T16:21:36.563085+00:00","2026-10-15T16:21:36.544+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fcheckmarx.com\u002Fzero-post\u002Fpep-829-makes-python-startup-safer-but-risk-remains\u002F","pep-829-makes-python-startup-safer-but-risk-remains-e882a0","PEP 829 Makes Python Startup Safer, But Risk Remains",[29,35,41],{"id":30,"name":31,"slug":32,"description":33,"color":34},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":36,"name":37,"slug":38,"description":39,"color":40},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49],{"slug":50,"name":51,"problem":52},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]