Interactive REPL/Environment variable

PYTHONSTARTUP environment variable

After interpreter startup, before the REPL prompt appears (interactive mode only)

Lives in: PYTHONSTARTUP environment variable
Attacker needs: Environment control
Lifecycle: Install
Startup
your code
Module load
Runtime
REPL
Runs only in interactive sessions, so it targets developers.

How it runs

The PYTHONSTARTUP env var points to a file that runs when the interactive REPL starts. It does not run when you execute a script. Only the REPL triggers it.

export PYTHONSTARTUP=/tmp/script.py
python   # runs /tmp/script.py before the prompt appears

That limit makes it less useful against servers, but it suits attacks on developers. If you can write to someone's shell profile or .env file, your code runs first every time they open a Python shell to debug something.

Defend

Treat shell profiles and .env files as code; unset PYTHONSTARTUP in shared/CI shells; review dotfiles for unexpected values.