Suspicious Python PTH File Creation (TeamPCP LiteLLM Campaign)

Danny Y@zendannyy

•updated Mar 31, 2026•11•0•527

Detects the creation of .pth files inside a Python site-packages or dist-packages directory. This technique was leveraged by TeamPCP in the LiteLLM supply chain attack to gain automatic execution every time the Python interpreter was started.