REPORTED DEVELOPMENT
Microsoft Security Research analysed the 21 October LiteLLM 1.107.0 compromise. Malicious components could activate at Python-interpreter startup without importing or using LiteLLM. Microsoft documented corresponding Windows and macOS behaviour, including activation during an unrelated Python operation.
Its guidance warns against starting Python or pip in a suspect environment to investigate because that could reactivate malicious code; analysis should use tools from a trusted environment. This is new technical scope and investigation guidance for the existing attack, not a new attack or CVE.
WHY IT MATTERS TO THE MARKET
Checking application imports alone would be insufficient: affected Python environments, dependencies, caches, container images and development systems can matter.