PyPI Malware

Key Takeaways Hades shipped .pth startup hooks, so the payload fired every time Python started rather than once at install. The same trick had already shipped inside LiteLLM eleven weeks...