MediumSupply chainBLWK-PERSIST-005

A Python startup hook runs code in every Python process

What this means

‹path› runs code every time Python starts in this environment, before your own program and even if you never import the package that added it. Some tools use this legitimately, but it is also how the poisoned LiteLLM 1.107.0 package stole credentials in October 2026.

How to fix it

Check where this file came from, and remove it if you don't recognise it.

1. Find the package that installed it: pip show -f <package> lists a package's files.
2. If you recognise it, ignore this issue with the package name as the reason.
3. If you don't, uninstall that package and rotate any secrets this Python environment could read.

Check it yourself

Run a scan and look for BLWK-PERSIST-005 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads python_startup_hooks and reports this check when:

executes_code == true and known_benign == false and malicious_name == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1546.018
• MITRE ATT&CK T1195.001

Related checks

• Traces of the LiteLLM 1.107.0 credential stealer were found · BLWK-ROOTKIT-002
• An MCP server runs an unpinned package from a registry · BLWK-AI-003
• An MCP server uses mcp-remote (critical command-injection ≤ 0.1.15) · BLWK-AI-004
• An MCP server launches via a shell interpreter · BLWK-AI-005
• An MCP server runs a privileged or host-mounting container · BLWK-AI-019