A file dropped into the Python packages folder is processed by the interpreter itself, so the code runs even if the program never imports anything from it. MITRE tracks this as T1546.018.
How it works
MITRE says adversaries may use Python’s startup mechanisms for persistence. These are path configuration files with the .pth extension, and the sitecustomize.py or usercustomize.py modules. Python processes them automatically when the interpreter initializes, so arbitrary code can run whenever Python is invoked.
MITRE explains that a .pth file placed in a site-packages or dist-packages folder has any line that begins with import executed on every Python run. A sitecustomize.py or usercustomize.py file in the Python path is imported at startup, and the code in it runs. MITRE adds that adversaries may abuse this on systems where Python is widely used, for example for automation or scripting in production.
A real example
MITRE lists the TeamPCP Cloud Stealer, which used .pth files to persist on compromised hosts, and Mini Shai-Hulud, which used Python startup hooks to run through the .pth import mechanism. On 21 October 2026 Socket mapped the malicious LiteLLM 1.107.0 release to this technique. A cook.pth file imported a stealer at every Python start, and a sitecustomize.py file started a background loader.
In March 2026, LiteLLM 1.82.8 also carried a .pth file, litellm_init.pth, per a public GitHub issue and the PyPA advisory. On 23 October Microsoft described the same case: the cook.pth file has a single executable line, import cook, that loads a collector in a background thread, and Microsoft saw a routine Python command that installed an unrelated dependency on Windows start it.
See the LiteLLM 1.107.0 incident profile and our LiteLLM 1.107.0 response checklist. The same release also used a dead drop resolver (T1102.001) to find its remote code server, per StepSecurity.
Seen in incidents
How to detect
-
New .pth, sitecustomize.py or usercustomize.py files
MITRE's detection strategy DET0258 looks for unauthorized creation or change of Python hook files in site-packages, dist-packages or user paths.
-
Python that starts without a user
MITRE says to correlate those file writes with unexpected interpreter runs, such as python3 starting without user interaction, and with changes in interpreter behavior such as malicious imports.
-
Network traffic from Python
MITRE also points to outbound connections started from Python, and to child processes that look out of place, after a hook file was written.
-
Do not trust the file name alone
Socket notes that sitecustomize.py can be a legitimate file, so a hit on the name is a reason to read the file, not proof of compromise.
-
Hunt for the hook files and their traces
Microsoft's LiteLLM guidance gives hunting leads: known hashes of the startup files, connections to the collector domain, and OpenSSL commands that use .pc_e_ staging folders. Microsoft says they are leads, not verdicts, so confirm a hit with process, network and identity logs.
How to defend
-
Know the limit of prevention
MITRE says this technique cannot be easily mitigated with preventive controls, because it abuses system features. Detection and package hygiene matter more.
-
Block the bad package and verify what you install
Socket's LiteLLM advice is to block the bad version and compare published distributions against the intended source, including data folders and startup files.
-
Rebuild instead of cleaning in place
LiteLLM tells affected users not to run pip install first, because Python startup re-runs the malicious files. It recommends rebuilding images and virtual environments from scratch.
-
Look for hook files after an incident
List every .pth, sitecustomize.py and usercustomize.py in your site-packages folders and read the ones you did not put there.
-
Rebuild from verified artifacts
Microsoft says removing the package or its release tag is not a recovery. Confirm that the three startup files are gone from the library path, rebuild from verified artifacts, and use hash-pinned lock files and image digests.
Frequently Asked Questions
What is a .pth file?
MITRE describes it as a path configuration file that extends Python's module search path. A line that begins with import in such a file is executed when Python starts.
Does the malware run if I never import the package?
Yes, for this technique. MITRE says the hook files run whenever Python is invoked, and SafeDep says the LiteLLM 1.107.0 files ran even on hosts where litellm was never imported.
Is sitecustomize.py always malicious?
No. Socket notes that the file name can be legitimate, so check who created the file and what it contains.
Sources
- Event Triggered Execution: Python Startup Hooks, T1546.018MITRE ATT&CK
- Event Triggered Execution, T1546MITRE ATT&CK
- LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI CredentialsSocket
- Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and BackdoorSafeDep
- Contained: Oct 21, 2026 LiteLLM release v1.107.0 CompromisedLiteLLM (BerriAI)
- PYSEC-2026-2 litellm advisoryPython Packaging Authority advisory database
- SECURITY: litellm 1.82.8 on PyPI contains malicious credential-stealing payload (litellm_init.pth), Issue #24521BerriAI/litellm on GitHub
- Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooksMicrosoft Security
