lote.guide catalogues implicit execution primitives in Python and Node.js: the files, environment variables, CLI flags, and module hooks that run on install, at interpreter startup, on import, when a command starts, and in an interactive REPL.
Each entry records where the primitive lives, what an attacker needs to use it, how it runs, a case seen in the wild, and how to defend it. The catalog currently holds 26 primitives. One of them is Python .pth files: a line beginning with import executes during site setup, before the entrypoint. The LiteLLM incident in 2026 used that path. A compromised package dropped a .pth into site-packages that ran on every Python startup.
