When Python byte code bites: Who checks the contents of compiled Python files?

During our continuous threat hunting efforts to find malware in open-source repositories, the ReversingLabs team encountered a novel attack that used compiled Python code to evade detection. It may be the first supply chain attack to take advantage of the fact that Python byte code (PYC) files can be directly executed, and it comes amid a spike in malicious submissions to the Python Package Index (PyPI). If so, it poses yet another supply chain risk going forward, since this type …

attack code continuous detection dev & devsecops evade fact files find hunting malware may novel python repositories reversinglabs software supply chain security supply supply chain supply chain attack team threat threat hunting threat research