A .pth file inside an installed PyPI package auto-executes lines beginning with import on every Python interpreter start

Python's site-packages mechanism executes any line starting with import in a *.pth file at interpreter startup, before user code runs. The compromised litellm 1.82.7/1.82.8 (PyPI, ~40 min live, 2026-03) shipped a litellm_init.pth that harvested SSH keys, cloud credentials, k8s tokens, and .env files on every Python invocation, including unrelated scripts on the same machine. The behavior is documented in Python's site module but routinely missed by package reviewers and most malware scanners.

When auditing a PyPI package or hunting after a suspected compromise, grep installed site-packages for *.pth files (find $(python -c 'import site; print(site.getsitepackages()[0])') -name '*.pth' -print -exec cat {} \;) and inspect any whose contents do more than add a path. Combine with minimum-release-age to catch the smash-and-grab window before installation.