Python's Import Statement Is an Execution Boundary: 90% of Initialization-Activated Advisory Vulnerabilities Are High or Critical

arXiv 2609.14791·medium signalXBlueskyLinkedInCopy link

ImportMine combines security advisories with PyPI project histories to study code that runs during module and package initialization, before an application ever calls a package API. It confirms 1,429 project-history bugs across 1,302 repositories plus 31 import-related advisory vulnerabilities; 97.6% of initialization-activated history bugs stop or disrupt normal execution, while 90.0% of the 20 initialization-activated advisory vulnerabilities are rated High or Critical. Module-level code and package initialization activate 98.3% of analyzed cases, and many fixes change when an import becomes active rather than removing the dependency.