Python pth Site-Packages Persistence

A .pth file whose line begins with 'import' is executed by the CPython site module at every interpreter startup. Malware drops such a .pth into site-packages to launch a payload on every Python invocation, package-independent and surviving pip uninstall of the dropper.