New Forensic Tool Reveals What Python Apps Actually Run at Runtime, Bypassing Traditional Supply Chain Analysis

Software supply chain attacks have become a major concern as applications pull in increasing numbers of third-party libraries from public repositories. To counter this risk, organizations now widely rely on Software Bills of Materials (SBOMs)—detailed inventories of components and their relationships—as a security baseline. But traditional SBOMs built from package metadata or the filesystem fall short: they don't capture what actually loads and runs when an application executes, particularly in dynamic environments like Python.

The Gap in Current SBOM Tools#

Generating an accurate runtime picture of dependencies has historically required advance instrumentation—essentially embedding monitoring code before the system runs. This approach stumbles in real-world scenarios: production environments rarely allow pre-deployment monitoring, and incident-response teams often work with systems already in motion. Standard SBOM approaches therefore miss dynamic module loading and can fail to detect which packages are genuinely invoked during execution.

A Memory-Based Solution#

Researchers from the security community have introduced MEM-SBOM, a memory forensics framework that flips the approach on its head. Rather than relying on metadata or filesystem snapshots, the system extracts SBOMs directly from a running application's volatile memory—the RAM state at any given moment. This doesn't require pre-instrumentation and works on systems already operational, making it viable for incident response and post-execution analysis.

How It Works#

MEM-SBOM—implemented as a suite of plugins for Volatility 3, a leading memory analysis platform—recovers loaded modules by reading the Python interpreter's internal data structures. The framework then resolves package versions, examines bytecode to map dependencies, and identifies functions that might be vulnerable. In testing against 51 real-world Python applications, it achieved 100% extraction accuracy and uncovered runtime packages that other SBOM tools had overlooked.

Real-World Impact#

The evaluation yielded notable findings: MEM-SBOM identified Streamlit as the sole application that executed vulnerable functions in its Tornado dependency—a detail that traditional static analysis had missed. By capturing the genuine runtime state, the tool provides more accurate vulnerability assessments and supply chain visibility than existing approaches.