lote.guide
esc
  • npm lifecycle scriptsscripts field in package.jsonNode.js
  • setup.py arbitrary code executionsetup.py in source distributions (sdist)Python
  • NODE_OPTIONS preload injectionNODE_OPTIONS environment variable, CLI flags, or .env files loaded via --env-fileNode.js
  • .pth file import execution*.pth files on sys.path (commonly site-packages)Python
  • binding.gyp / node-gyp native compilationbinding.gyp file in the package rootNode.js
  • Corepack (packageManager field)"packageManager" field in package.json, COREPACK_HOME cache directoryNode.js
  • .npmrc registry manipulation.npmrc file (project, user, or global)Node.js
  • overrides / resolutions dependency swapoverrides (npm) or resolutions (Yarn) field in package.jsonNode.js
  • pnpm hooks (pnpmfile.cjs).pnpmfile.cjs in the project rootNode.js
  • .yarnrc.yml plugins and registry.yarnrc.yml in the project rootNode.js
  • pyproject.toml build backendspyproject.toml [build-system] tablePython
  • sitecustomize / usercustomize auto-importsitecustomize.py / usercustomize.py on sys.path (usually site-packages)Python
  • .node native addon loading.node files in node_modules/ (typically under build/Release/ or prebuilds/)Node.js
  • Yarn Plug'n'Play (.pnp.cjs).pnp.cjs in the project rootNode.js
  • __init__.py execution on import__init__.py in any package directory on sys.pathPython
  • .pyc bytecode cache poisoning.pyc files in __pycache__/ directories alongside source modulesPython
  • PYTHONPATH / PYTHONHOME module shadowingPYTHONPATH / PYTHONHOME environment variablesPython
  • npx / npm exec remote executionnpx, npm exec, npm create / npm init (initializer flows)Node.js
  • conftest.py auto-loading (pytest)conftest.py files in any directory pytest traversesPython
  • NODE_PATH environment variableNODE_PATH environment variableNode.js
  • "imports" field (subpath imports)imports field in package.jsonNode.js
  • require.extensions / Module._extensionsrequire.extensions / Module._extensions in any loaded moduleNode.js
  • .egg files and EGG-INFO scripts.egg files in site-packages (registered via easy-install.pth)Python
  • Zip imports (zipimport).zip / .pyz files on sys.path, or passed directly to the interpreterPython
  • PYTHONSTARTUP environment variablePYTHONSTARTUP environment variablePython
  • node_modules/.hooks/ directorynode_modules/.hooks/ directoryNode.js
Python
Interpreter startup/File on disk

sitecustomize / usercustomize auto-import

During Python's standard site initialization at interpreter startup

Lives in
sitecustomize.py / usercustomize.py on sys.path (usually site-packages)
Attacker needs
Filesystem write access, Supply-chain foothold
Lifecycle
Install
Startup
your code
Module load
Runtime
REPL

Runs while the interpreter boots, before your entrypoint.

How it runs

Same idea as .pth files, different mechanism. Python automatically imports sitecustomize.py and usercustomize.py if they exist on the import path.

sitecustomize.py is meant for system-wide or environment-wide customization, such as org defaults, path tweaks, corporate bootstrapping and debugging hooks. It affects everyone using that environment. usercustomize.py is the per-user version. It only loads if user site-packages are enabled:

python3 -c "import site; print(site.ENABLE_USER_SITE)"

The attack is obvious. Drop a sitecustomize.py into any directory on sys.path and your code runs before main on every Python invocation in that environment. It's less stealthy than a .pth, since the filename draws attention. It's also more powerful, because you get a full Python module instead of single import lines.

Defend

Audit for unexpected sitecustomize/usercustomize modules; disable user site with python -s; run with -S to skip site init in locked-down contexts.