lote.guide
esc
  • npm lifecycle scriptsscripts field in package.jsonNode.js
  • setup.py arbitrary code executionsetup.py in source distributions (sdist)Python
  • NODE_OPTIONS preload injectionNODE_OPTIONS environment variable, CLI flags, or .env files loaded via --env-fileNode.js
  • .pth file import execution*.pth files on sys.path (commonly site-packages)Python
  • binding.gyp / node-gyp native compilationbinding.gyp file in the package rootNode.js
  • Corepack (packageManager field)"packageManager" field in package.json, COREPACK_HOME cache directoryNode.js
  • .npmrc registry manipulation.npmrc file (project, user, or global)Node.js
  • overrides / resolutions dependency swapoverrides (npm) or resolutions (Yarn) field in package.jsonNode.js
  • pnpm hooks (pnpmfile.cjs).pnpmfile.cjs in the project rootNode.js
  • .yarnrc.yml plugins and registry.yarnrc.yml in the project rootNode.js
  • pyproject.toml build backendspyproject.toml [build-system] tablePython
  • sitecustomize / usercustomize auto-importsitecustomize.py / usercustomize.py on sys.path (usually site-packages)Python
  • .node native addon loading.node files in node_modules/ (typically under build/Release/ or prebuilds/)Node.js
  • Yarn Plug'n'Play (.pnp.cjs).pnp.cjs in the project rootNode.js
  • __init__.py execution on import__init__.py in any package directory on sys.pathPython
  • .pyc bytecode cache poisoning.pyc files in __pycache__/ directories alongside source modulesPython
  • PYTHONPATH / PYTHONHOME module shadowingPYTHONPATH / PYTHONHOME environment variablesPython
  • npx / npm exec remote executionnpx, npm exec, npm create / npm init (initializer flows)Node.js
  • conftest.py auto-loading (pytest)conftest.py files in any directory pytest traversesPython
  • NODE_PATH environment variableNODE_PATH environment variableNode.js
  • "imports" field (subpath imports)imports field in package.jsonNode.js
  • require.extensions / Module._extensionsrequire.extensions / Module._extensions in any loaded moduleNode.js
  • .egg files and EGG-INFO scripts.egg files in site-packages (registered via easy-install.pth)Python
  • Zip imports (zipimport).zip / .pyz files on sys.path, or passed directly to the interpreterPython
  • PYTHONSTARTUP environment variablePYTHONSTARTUP environment variablePython
  • node_modules/.hooks/ directorynode_modules/.hooks/ directoryNode.js
Python
Module resolution/File on disk

Zip imports (zipimport)

On import (if on sys.path) or on direct invocation (python archive.zip)

Lives in
.zip / .pyz files on sys.path, or passed directly to the interpreter
Attacker needs
Filesystem write access, Environment control
Lifecycle
Install
Startup
your code
Module load
Runtime
REPL

Runs on import or require, for every module the app loads.

How it runs

Python's import system doesn't stop at plain source files. The built-in zipimport hook treats a .zip on sys.path like a regular directory and imports modules from inside it. It's always active and needs no configuration.

The real danger is module shadowing. Pack a json.py into a zip, add it to PYTHONPATH, and every import json loads your version instead of the stdlib one:

python3 -c "import zipfile; z=zipfile.ZipFile('vendor-utils.zip','w'); z.write('json.py'); z.close()"
PYTHONPATH=vendor-utils.zip python3 -c "import json"

Zip files are opaque. You can't ls inside them without extra tools, and reviewers miss them easily. Pair this with .pth files or PYTHONPATH injection for a clean two-stage attack. One mechanism adds the zip to the path, and the zip contains the shadowed module.

Defend

Flag archives on sys.path in audits; unpack and inspect .zip/.pyz contents; combine with PYTHONPATH hygiene.