Hidden in Plain Sight: Unveiling the Potential Threat of Duck Typing Misuse in Python Open-Source Software Projects

Review for ISSTA 2026We have uploaded the analysis results of sample_repo along with a container image containing an attack demonstration for reviewers to download and inspect. For detailed descriptions and usage instructions, please refer to the following link: https://anonymous.4open.science/r/Real-Mis-DuckRebuttal for ISSTA 2026We have uploaded the subgraphs of 9720 versions of duck-typing-misused OSS projects mentioned in the paper to show the continuous growth. All C2RG of these versions are too large, and cannot be uploaded to the website. We upload the analysis results of C2RG and promise upload complete data in the future.