A GENERAL INFORMATION

1. Title of the software: Replication Data for: "From Constrictor to Serpent: Investigating the Threat of Cache Poisoning in the Python Ecosystem"

2. Brief desciption of the software's purpose or functionality: This code artifact contains tools for analyzing and replicating Python cache files obtained from package artifacts.

3. Version: 0.1.0

4. Author and contact Information:

	A. Investigator Contact Information
		Name: Marc Ohm
		Institution: University of Bonn, Fraunhofer FKIE
		Address: Friedrich-Hirzebruch Allee 8, 53115 Bonn, Germany
		Email: ohm@cs.uni-bonn.de
		ORCID: 0000-0002-2913-5270
		Role: Developer

	B. Investigator Contact Information
		Name: Timo Pohl
		Institution: University of Bonn
		Address: Friedrich-Hirzebruch Allee 8, 53115 Bonn, Germany
		Email: pohl@cs.uni-bonn.de
		ORCID: 0009-0002-3760-7976
		Role: Developer

	C. Investigator Contact Information
		Name: Ben Swierzy
		Institution: Fraunhofer FKIE, University of Bonn
		Address: Friedrich-Hirzebruch Allee 8, 53115 Bonn, Germany
		Email: swierzy@cs.uni-bonn.de
		ORCID: 0009-0003-0485-4791
		Role: Developer

	D. In case of questions related to this dataset, please contact:
		Name: Marc Ohm
		Institution: University of Bonn, Fraunhofer FKIE
		Address: Friedrich-Hirzebruch Allee 8, 53115 Bonn, Germany
		Email: ohm@cs.uni-bonn.de
		ORCID: 0000-0002-2913-5270
		Role: Developer

B PROJECT OVERVIEW

1. Full description of the software's purpose or functionality:
	1.1 Proof of Concept how to inject and install a package with benign source code and malicious cache file
	1.2 Longitudinal reproduction of cache files from PyPI artifacts
	1.3 Examination of failed reproduction attempts

2. Date of creation: 2026-01-20

3. Project Organization: 
	3.1 bytecode-analyzer: Utilities for investigating differences in Python cache files
	3.2 cache-reproduction-tests: Scripts to automatically attempt to reproduce cache files
	3.3 proof-of-concepts: Construction of packages with malicious cache files but benign source files
	3.4 pyc-finder: Search for Python cache files in an artifact
	3.5 pyproject.toml: Packaging system metadata
	3.6 *.md, *.txt: Documentation

	Packaging system metadata and documentation describe the files in the respective directories.
	


C INSTALLATION

1. Step by step instructions:
	1.1 Run "uv sync" in the project root directory to download all Python dependencies

2. System requirements: Python 3.13; Docker 29.1.4

3. Required libraries, packages, modules: 
	3.1 List of Python packages containing cache files: https://doi.org/10.60507/FK2/EADABS
	3.2 pydantic 2.11.7 https://github.com/pydantic/pydantic
	3.3 requests 2.32.5 https://docs.python-requests.org/en/latest/index.html
	3.4 docker 7.1.0 https://github.com/docker/docker-py
	3.5 urllib3 2.5.0 https://github.com/urllib3/urllib3
	3.6 siphash24 1.8 https://github.com/dnicolodi/python-siphash24/
	3.7 beautifulsoup4 4.13.5 https://www.crummy.com/software/BeautifulSoup/
	3.8 semantic_version 2.10.0 https://github.com/rbarrois/python-semanticversion
	3.9 uv 0.9.26 https://docs.astral.sh/uv/
	3.10 setuptools 77.0.3 https://setuptools.pypa.io/en/latest/
	3.11 twine 6.2.0 https://twine.readthedocs.io/en/stable/
	3.12 build 1.3.0 https://build.pypa.io/en/stable/

4. Setup requirements:
	4.1 Proof of Concept: requires environment variables `TWINE_USERNAME`, `TWINE_PASSWORD`, `TWINE_REPOSITORY_URL` (see https://twine.readthedocs.io/en/stable/#environment-variables)

5. Known issues: -


D USAGE

1. Step by step instructions:
	1.1 Proof of Concept: refer to proof-of-concept/README.md for further instructions
	1.2 Pyc Finder: refer to pyc-finder/README.md for further instructions
	1.3 Cache Reproduction Tests: refer to cache-reproduction-tests/README.md for further instructions
	1.4 Bytecode Analyzer: refer to bytecode-analyzer/README.md for further instructions

2. Known limitations: Old Python versions (<= 3.4) cannot be used for reproduction with modern docker installations, since their Docker images use the deprecated Manifest v1 format

3. Is the code commented? yes


E LICENSE

1. Software License: MIT


F ACKNOWLEDGEMENTS

1. Funding Sources: -

2. Publications using the Software: tba

3. Links/relationships to ancillary material:
	3.1 List of Python packages containing cache files: https://doi.org/10.60507/FK2/EADABS

4. Project is available: https://doi.org/10.60507/FK2/TNJHGT

5. Contributors:
	5.1 Marc Ohm: Developer of Proof of Concept and Pyc Finder
	5.2 Timo Pohl: Developer of Cache Reproduction Artifact
	5.3 Ben Swierzy: Developer of Bytecode Analyzer