Securing Python Supply Chain: Using Graph Theory for Vulnerability Prediction

The open-source Python ecosystem is a complex system whose community-driven nature creates significant software assurance challenges. This study develops a foundational, graph-theory-based technique for proactively predicting vulnerability in these critical supply chains. Modeling the Python Package Index (PyPI) as a directed graph of 411,056 packages, we evaluate how network centrality metrics, such as indegree, betweenness, and PageRank, serve as proxies for security risk. Our analysis demonstrates their significant power to predict both direct and indirect, dependency-propagated vulnerabilities. The results reveal how a few high-centrality nodes can cascade risk across thousands of downstream packages. This approach provides a scientific basis for ensuring system integrity, enabling new tools and practices to identify systemic weaknesses before exploits occur, and bridging the gap between collaborative innovation and robust cybersecurity.