Python's import statement is an execution boundary, and 90% of initialization-activated advisory vulns are High or Critical.

ImportMine combines security advisories with PyPI project histories to study code running during module and package initialization, before an application calls any API (arXiv 2609.14791). It confirms 1,429 project-history bugs across 1,302 repositories plus 31 import-related advisory vulnerabilities; 97.6% of initialization-activated history bugs stop or disrupt execution, and 90.0% of the 20 initialization-activated advisory vulnerabilities rate High or Critical. Module-level code activates 98.3% of analyzed cases, and many fixes change when an import becomes active rather than removing the dependency.