A source distribution, or sdist, is a Python package format that ships source files instead of prebuilt binaries. When installed, the package manager may need to build the project locally, which can trigger setup steps, compilation, or other install-time logic. That makes sdists flexible for developers, but also riskier than purely prebuilt packages because the install process can execute code before the package is fully trusted.
In cyber security, sdists matter because attackers can hide malicious behavior in build scripts, dependency hooks, or packaging metadata that runs during installation. Defenders reduce this risk by preferring pinned, verified packages, reviewing build files, using isolated build environments, and blocking unnecessary source builds in production pipelines. In practice, sdist risk shows up wherever automated systems install dependencies without human review, turning a routine package fetch into a potential execution path.