PyFEX: Uncovering Evasive Python-based Threats via Resilient and Exhaustive Path Exploration
2026-06-01 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors address two growing problems: harmful Python packages and malicious programs made from Python code. They created PyFEX, a tool that looks at all parts of a program by forcing it to run through every possible path, even hidden or hard-to-reach ones. PyFEX also fixes crashes during analysis by creating fake objects so it can keep going and find hidden bad behaviors. They made a malware detector called PyFEXScan using this tool and found many dangerous packages that other tools missed, showing their method is helpful for keeping Python software safe.
Python Package Index (PyPI)Software supply chainStatic analysisDynamic analysisForced executionCrash recoveryPath explosionMalware detectionBytecodeAPI (Application Programming Interface)
Authors
Meng Wang, Yue Ma, Majid Garoosi, Wenting Fan, Liwei Guo, Jianqiang Wang, Ali Abbasi
Abstract
The rapid expansion of the Python ecosystem has fueled two distinct but converging threats: adversaries increasingly target the software supply chain via the Python Package Index (PyPI), while also building evasive, cross-platform malicious binaries compiled from source code written in Python. Current program analysis techniques struggle to address this dual threat. Static analysis based tools are often blinded by runtime obfuscation and compiled bytecode, while dynamic analysis based ones are fragile, prone to evasion by environmental guardrails, and often terminates prematurely due to unsatisfied dependencies. To overcome these limitations, we present PyFEX, a resilient forced-execution engine. PyFEX explores a program's behavioral space systematically by forcing execution across all conditional branches to bypass evasion checks. To address the fragility of dynamic execution, it introduces a novel resilient crash recovery mechanism that synthesizes dummy objects to satisfy failed operations at the runtime, allowing analysis to proceed past fatal errors, and employs path merging to mitigate path explosion. PyFEX further incorporates an automated entry identification mechanism that proactively discovers and invokes dormant functions, exposing malicious logic hidden within uncalled APIs. To demonstrate the efficacy of this engine, we built PyFEXScan, a proof-of-concept malware detector built on top of PyFEX. Evaluated against both known malicious PyPI packages and real-world compiled binaries, PyFEX exposes critical behaviors missed by the existing state-of-the-art tools. In a live deployment on PyPI, PyFEXScan discovered 212 previously unknown malicious packages accounting for over 91,648 downloads, underscoring the necessity of resilient, exhaustive analysis for securing the Python ecosystem.