This file was generated on 2026-01-20 by Ben Swierzy


A GENERAL INFORMATION

1. Title of the dataset: Replication Data for: "From Constrictor to Serpent: Investigating the Threat of Cache Poisoning in the Python Ecosystem"

2. Brief description of the research project and its aims: The dataset contains Package-URLs (PURLs) and SHA-256 checksums of Python packages from PyPI which contain at least one cache file (*.pyc).

3. Author Information
	A. Investigator Contact Information
		Name: Marc Ohm
		Institution: University of Bonn, Fraunhofer FKIE
		Address: Friedrich-Hirzebruch Allee 8, 53115 Bonn, Germany
		Email: ohm@cs.uni-bonn.de

	B. Investigator Contact Information
		Name: Timo Pohl
		Institution: University of Bonn
		Address: Friedrich-Hirzebruch Allee 8, 53115 Bonn, Germany
		Email: pohl@cs.uni-bonn.de

	C. Investigator Contact Information
		Name: Ben Swierzy
		Institution: Fraunhofer FKIE, University of Bonn
		Address: Friedrich-Hirzebruch Allee 8, 53115 Bonn, Germany
		Email: swierzy@cs.uni-bonn.de

	D. In case of questions related to this dataset, please contact:
		Name: Marc Ohm
		Institution: University of Bonn, Fraunhofer FKIE
		Address: Friedrich-Hirzebruch Allee 8, 53115 Bonn, Germany
		Email: ohm@cs.uni-bonn.de

4. Date of data collection: 2025-08-09 

5. Information about funding sources that supported the collection of the data: n/a 

6. Language of the dataset: English

7. Geographic location of data collection: n/a 



B DATA & FILE OVERVIEW

1. File List: 
	1.1 analyzed_artifacts.csv: tabular data comprising a list of Python packages that include a cache file

2. Are there multiple versions of the dataset? no

3. Relationship between files: n/a

4. Related sources:
	4.1 Analysis Software: https://doi.org/10.60507/FK2/TNJHGT



C SHARING/ACCESS INFORMATION

1. Was data derived from another source? yes, from the Python package index (PyPI, https://pypi.org/)

2. Licenses/restrictions placed on the data: CC-BY 4.0

3. Links to publications that cite or use the data: tba

4. Links to other publicly accessible locations of the data: -

5. Links/relationships to ancillary datasets: -



D METHODOLOGICAL INFORMATION

1. Description of methods used for collection/generation of data: The latest version of every package on PyPI was downloaded

2. Methods for processing the data:  
	2.1 The artifact type is inferred from the file extension
	2.2 The PURL is built from the package metadata on PyPI
	2.3 The hash is calculated by us

3. Instrument- and/or software-specific information needed to interpret the data: 
	3.1 Any CSV compatible tool (e.g., Python, LibreOffice Calc, Microsoft Excel)

4. People involved in sample collection, processing, analysis and/or submission:
	4.1 Marc Ohm
	4.2 Timo Pohl
	4.3 Ben Swierzy

5. Describe any quality-assurance procedures performed on the data: Packages have been filtered to contain at least one cache file

6. Standards and calibration information: n/a

7. Environmental/experimental conditions: n/a 



E DATA-SPECIFIC INFORMATION FOR: analyzed_artifacts.csv

1. Variable list including full names and definitions (please spell out abbreviated words) of column headings for tabular data:
	1.1 artifact: Artifact Type. Possible Values: sdist (source distribution), wheel (Python Wheel)
	1.2 purl: Package URL (PURL). Example: pkg:pypi/unicef-power-query@0.4. Specification at https://github.com/package-url/purl-spec
	1.3 hash: SHA-256 hash of the artifact obtained when downloading the package referenced by the PURL