A .pth file in your site-packages folder can run code every time Python starts, with no import needed. The litellm advisory describes a malicious litellm_init.pth in version 1.82.8 that did exactly that. Auditing these files takes a few minutes and is worth doing on build machines.
What the advisory says
The advisory for the compromised litellm releases points to a file named litellm_init.pth in the 1.82.8 source archive, and says malicious code in 1.82.7 ran when a module was imported. Another listing on oss-security names the same files as reference points. The practical difference: an import based payload needs your code to load the package, while a startup file runs on any Python process in that environment.
How .pth files normally work
Python reads .pth files in site-packages at startup. The same documentation says newer Python versions deprecate those import lines, with the timeline set out on that page. Most lines are plain directory paths to add to the module search path. The Python documentation for the site module says lines starting with import followed by a space or tab are executed with exec(), and that such executable lines always run at startup unless the interpreter is started with the -S flag. Legitimate packages use this for editable installs and a few compatibility tricks, so the existence of such a line is not proof of malice. An unexpected one, in a package that has no reason to need it, is a flag.
A quick audit
Find the folder and list the files:
python -c "import site; print(site.getsitepackages())"
ls SITEPACKAGES_PATH/*.pth
Then print lines that start with import:
grep -H "^import" SITEPACKAGES_PATH/*.pth
Replace the path with the folder printed above. For each hit, ask whether you recognise the package, whether it was installed on purpose, and whether the line does something simple such as setting up a path hook.
What a suspicious file looks like
- A name that matches a package that does not obviously need startup code.
- A long, encoded or obfuscated string on one line.
- Code that opens network connections or reads environment variables.
- A recent modification date that matches no install you made.
Make this routine
Run the check in CI after dependency installation and fail the build on unknown startup lines. Keep a short allow list of known ones. Build from a lockfile with hashes, so the contents of a package cannot change without a diff.
Safeguard's SBOM and dependency scanning lists the packages in a repository, so you can see which environments contain a flagged version. The free scan is at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how each package and version is listed.
Quick check
Is every .pth file with an import line malicious?
No. Some legitimate packages use them. Check the owner and purpose of each one.
Does removing the package remove the risk?
Removing it stops new runs. If code already ran, rotate the secrets that environment could read.
Sources
- Python documentation, site module.
- GitHub Advisory Database, GHSA-5mg7-485q-xm76.
- oss-security, litellm compromise listing, 25 March 2026.
Last reviewed: 19 October 2026.
