Abstract:The safety of software package repositories is a critical aspect of software supply chain analysis, but existing research and tools often lack effective analysis of foreign language calls in the package repositories. As the official package repository for Python, PyPI stores a vast amount of Python software packages from various application domains. In addition to programs written in Python, these packages often include C/C++ foreign language programs that are called via Python’s foreign interface—the Python/C API. Analyzing the safety of foreign language calls in Python package repositories is crucial for ensuring the safety and reliability of software supply chains. By analyzing official documentation for interoperability and relevant methods and tools for interoperability program analysis, a bug benchmark suite for Python-C/C++ interoperability programs is established. This suite includes benchmark test programs for 15 bug patterns across nine categories, covering five language features of the memory, type, exception, concurrency, and numerical issues, as well as interoperability program bugs in the 16 most installed PyPI software packages that involve C/C++ foreign calls. By evaluating the existing state-of-the-art Python-C/C++ interoperability bug checkers on the bug benchmark suite, a comparative analysis of the reliability, completeness, and scalability of existing research and tools is conducted, with the current status and limitations of Python-C/C++ interoperability safety analysis analyzed and summarized. By analyzing more than 700 bug warnings, 21 new real-world bugs across three bug patterns are found in six PyPI repositories.