Software Supply Chain
Startup Hook
Also: .pth file, sitecustomize
A file the language runtime runs automatically every time it starts, before your own code, such as a Python .pth file or sitecustomize module.
In more detail
Startup hooks have legitimate uses, but malware likes them because the code runs in every Python process in that environment, even if the malicious package is never imported. Removing the package may not remove the hook files, so the environment has to be rebuilt.