Hades hid PyPI malware in 26 packages using .pth startup hooks

Key Takeaways Hades shipped .pth startup hooks, so the payload fired every time Python started rather than once at install. The same trick had already shipped inside LiteLLM eleven weeks...