Comment by codedokode

As I understand, they use static analysis. So the malicious code can be hidden by obfuscation.

For example, instead of writing

    open('/etc/password')

One can write

    method = calculateMethodName()
    name = calculateEtcPassword()
    geattr(__builtins__, method)(name)