Malicious LiteLLM .pth Persistence

nomit vyas@xoxo

•updated Apr 20, 2026•3•1•495

Detects the creation or modification of a .pth file named LiteLLM_init.pth in Python site-packages directories. This provides high-fidelity identification of the Python interpreter startup persistence mechanism used by TeamPCP in the LiteLLM supply chain compromise.