Please note: This master’s thesis presentation will take place in DC 2564 and online.
Mohammad Jaffer Iqbal, Master’s candidate
David R. Cheriton School of Computer Science
Supervisors: Professors Michael Godfrey, Pengyu Nie
Packages in the Python Package Index (PyPI) declare direct dependencies that may download additional packages transitively. When a package becomes vulnerable, any other package that can reach it through a transitive dependency path may also become exposed, even if the vulnerable package lies several hops away in the path. Accurately measuring this exposure is challenging. Prior work either traces paths through reachability analysis on the dependency graph (which is prone to overestimation because not every declared dependency path can be realized by the installer) or examines actual installations via ecosystem tooling for only small samples, often at a single point in time.
This thesis measures transitive vulnerability exposure in PyPI packages. We adopt a stricter, possibility-based definition. A dependent-release (release of a dependent package) is exposed at a given time if its then-available requirements admit any valid installation that selects the root-version (affected release of a vulnerable package), either directly or transitively. To find exposures at ecosystem scale, we utilize pip’s dependency resolution logic over an offline reconstruction of PyPI’s historical dependency graph. For a dependent-package, we model exposure durations as windows that open and close over time, recording when each window opens, how long it remains open, and why it closes. We compare these results with those produced by the naive reachability-based approach used in prior works.
Our analysis identifies 7.71 million resolution-confirmed exposure windows spanning 1,545 PYSEC advisories and 291,089 dependent packages. The results show that transitive vulnerability exposure is widespread and persistent. Among packages capable of reaching a vulnerable version, 80% become exposed at least once. Exposure is concentrated in a small set of widely used packages like urllib3, pillow, and django. The exposure duration also varies non-monotonically with dependency depth: it increases from depth 1 (direct) to depth 2 (the first transitive level), then declines at greater depths, forming an inverted-U pattern that differs from prior findings in the Maven ecosystem. For 84% of windows, a fixed version was already available when exposure began, with a median lead time of 3.8 years, yet later dependent releases continued to admit the vulnerable version. Compared with resolution-based analysis, naive graph reachability identifies 1.47× as many exposure windows and overestimates total exposure time by 43%, with the largest differences occurring in deeper dependency chains. Together, these findings provide a broad view of PyPI’s transitive vulnerability exposure, showing how exposure is distributed, how long it persists, and how strongly its measurement depends on dependency resolution.
To attend this master’s thesis presentation in person, please go to DC 2564. You can also attend virtually on Zoom.