Malicious Python Releases Reach Developer Secrets at Startup
A bad Python package can start running before anyone imports it, which makes normal dependency checks miss the moment code begins stealing secrets. In this case, the trap sat in a .pth file, so the interpreter executed it on startup inside AI and build environments that already hold cloud and SSH credentials.
TeamPCP pushed malicious LiteLLM releases 1.82.7 and 1.82.8 through PyPI, and the same campaign also hit Aqua Security Trivy and Checkmarx KICS. Reporting says the payload targeted AWS, GCP, and Azure tokens, SSH keys, and cloud account credentials, with the packages live for about three hours before quarantine.
The risk is bigger than one package install. In developer environments that bridge into CI and production, startup-time execution turns a trusted library into a secret-harvesting pivot across the rest of the toolchain.