Python .pth files deserve special attention because they can influence interpreter startup. In some environments, a .pth file can cause code to run when Python starts. That makes any untrusted package or writable site-packages directory a serious supply-chain risk.
The defensive lesson is broader than one LiteLLM incident: do not install AI dependencies directly into a production interpreter without pinning, review, and isolation. Use a virtual environment, lock dependencies, verify package sources, and run installation jobs with the minimum permissions required.
Useful controls include inspecting installed files, monitoring unexpected changes under site-packages, disabling unnecessary startup behavior where compatible, and testing packages in an isolated build environment before deployment. Container images should be rebuilt from known inputs rather than modified manually on running servers.Copy
python -m pip install --require-hashes -r requirements.txt
python -m pip list --outdatedDo not copy proof-of-concept exploit code into a production system. If you suspect compromise, preserve logs, isolate the affected environment, rotate secrets from a clean machine, rebuild the environment, and consult the package maintainer’s advisory and the relevant CVE record.
The key takeaway is simple: AI applications are Python applications, so normal Python supply-chain hygiene still applies. Treat model tooling, plugins, and transitive dependencies as production code.