Python Exposes Phantom Dependencies With SBOM Screening

August 14, 2025

, By The New Stack

Share via:

In June, Python programmer Seth Michael Larson was hired by the Python Software Foundation to act as security-developer-in-residence. But he was already working on what Python’s thorniest security problems are: Hidden software dependencies, or phantom dependencies.

The term “phantom dependencies” was coined by Endor Labs in 2023 to describe code embedded in an application that was not declared in any sort of manifest file, thus making it invisible to vulnerability scanners.

Every open source software package should have a manifest of…

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We StartupNews.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It’s possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.

Previous News

Instagram is developing a feature that helps users find shared interests

Next News

Report: Apple planning ecosystem of home security devices to compete with Ring and Nest

Popular

More Like this

Python Exposes Phantom Dependencies With SBOM Screening

August 14, 2025

, Published By The New Stack

In June, Python programmer Seth Michael Larson was hired by the Python Software Foundation to act as security-developer-in-residence. But he was already working on what Python’s thorniest security problems are: Hidden software dependencies, or phantom dependencies.

The term “phantom dependencies” was coined by Endor Labs in 2023 to describe code embedded in an application that was not declared in any sort of manifest file, thus making it invisible to vulnerability scanners.

Every open source software package should have a manifest of…

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We StartupNews.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It’s possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.

Website Upgradation is going on for any glitch kindly connect at office@startupnews.fyi

Previous News

Instagram is developing a feature that helps users find shared interests

Next News

Report: Apple planning ecosystem of home security devices to compete with Ring and Nest

More like this

Popular

Block title