60-second check: is anything hijacking your Python startup?
23 October 2026
The LiteLLM attack hid in .pth files, which Python executes automatically at startup when a line begins with 'import'. Run: python -c "import site; print(site.getsitepackages())" and then look in those folders for .pth files containing 'import' lines you don't recognise. Do it for every virtualenv and container you use for AI work.
Based on reporting by StepSecurity. Read their full coverage for details.