Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Sympy-dev malicious PyPI package delivers XMRig payloads on Linux

Malware Activity
First reported
Last updated
Happening score
H score 35
1 unique sources, 1 articles

Summary

Hide ▲

The malicious sympy-dev package on PyPI impersonates SymPy and delivers a downloader that can fetch and execute XMRig-related payloads on Linux hosts, creating cryptomining and post-install compromise risk. The package copied the legitimate project description and was downloaded over 1,100 times after publication on January 17, 2026, suggesting some users may have been exposed. Its malicious functions activate only when specific polynomial routines are called, helping the code stay hidden. The execution chain uses memfd_create and /proc/self/fd to run payloads in memory and reduce on-disk artifacts.

Related Happenings

Compromised @asyncapi npm packages distributing the Miasma loader

Malware Activity
H score29 First: 15.07.2026 12:16 Last: 15.07.2026 12:16 Sources 1

About this happening: Four compromised @asyncapi npm packages now deliver a multi-stage botnet loader when imported, exposing consumers to Miasma payloads during normal Node.js module load....

Open Happening

Operation Navy Ghost PyPI supply-chain campaign

Campaign
H score26 First: 01.07.2026 00:02 Last: 01.07.2026 00:02 Sources 1

About this happening: The Operation Navy Ghost campaign has targeted Python developers building Telegram bots through trojanized Pyrogram forks, creating a supply-chain path to compromi...

Open Happening

ZiChatBot PyPI supply-chain malware delivery

Malware Activity
H score30 First: 07.05.2026 12:20 Last: 07.05.2026 12:20 Sources 1

About this happening: A PyPI supply-chain attack used three packages to quietly deliver ZiChatBot, creating a cross-platform malware risk for Windows and Linux installs. The packages we...

Open Happening

PyTorch Lightning hit by network compromise

Incident
H score36 First: 04.05.2026 20:15 Last: 04.05.2026 20:15 Sources 1

About this happening: A malicious PyTorch Lightning release on PyPI created a supply-chain compromise that can steal credentials as soon as the package is imported. The backdoored version 2.6...

Open Happening

Lightning PyPI router_runtime.js credential-stealing payload

Malware Activity
H score29 First: 30.04.2026 19:31 Last: 30.04.2026 19:31 Sources 1

About this happening: The Lightning PyPI package was pushed in malicious versions 2.6.2 and 2.6.3 on April 30, 2026, turning a normal install into credential theft for developer and C...

Latest development: 04.05.2026 20:15

Microsoft Threat Intelligence says Defender detected and prevented the malicious `lightning==2.6.3` routine in customer environments, notified the Lightning maintainer, and warned that users who ran `import lightning` may need to rotate exposed secrets, keys, and tokens.

Open Happening

Timeline

  1. 22.01.2026 12:04 1 articles · 5mo ago

    sympy-dev published on PyPI as a SymPy impersonator

    Campaign Scope Update

    The malicious sympy-dev package was first published on PyPI on January 17, 2026, after copying SymPy's project description verbatim to pose as a development version of the library. The package targeted Linux hosts and established the distribution point for a downloader that later fetched XMRig-related payloads.

    Show sources
    Open in new tab
  2. 22.01.2026 12:04 2 articles · 5mo ago

    Security analysis details sympy-dev downloader behavior

    Initial Disclosure

    Security analysis identified sympy-dev as a malicious PyPI package that impersonates SymPy, triggers only when specific polynomial routines are called, and acts as a downloader for an XMRig cryptocurrency miner on compromised Linux hosts. The backdoored functions retrieve a remote JSON configuration, download a threat actor-controlled ELF payload from 63.250.56[.]54, and execute it in memory with Linux memfd_create and /proc/self/fd to reduce on-disk artifacts; the retrieved configurations use an XMRig-compatible schema that enables CPU mining, disables GPU backends, and points the miner to Stratum over TLS on port 3333.

    Show sources
    Open in new tab