I got a report of high load on our dev server. Claude code found it minutes. amazing. Found it! The malware is in a .pth file that auto-executes on every Python

  startup. Let me identify exactly which file:                                      

                                                                                    

  Searched for 1 pattern, read 1 file (ctrl+o to expand)                            

                                                                                    

● Root cause confirmed: litellm_init.pth — a malicious .pth file that spawns the

  malware on every Python startup. Now let me find which package installed it:      

                                                                                    

  Searched for 1 pattern (ctrl+o to expand)                                         

                                                                                    

● Root cause identified: litellm==1.82.8 is the compromised package. It contains

  litellm_init.pth which spawns malware on every Python startup. The local .venv has

   litellm-1.75.3 (safe), but the container got litellm-1.82.8 as a transitive      

  dependency of crawl4ai==0.8.0.