Malicious PyPI Package Impersonates SymPy, Deploys XMRig Miner on Linux Hosts

A new malicious package on the Python Package Index (PyPI) impersonates the symbolic maths library SymPy to deliver cryptomining payloads on Linux hosts, researchers have found. The package, sympy-dev, mirrors SymPy and has been downloaded over 1,100 times since first publication on 17 January 2026, with downloads continuing at the time of reporting.

According to Socket, the original library has been modified to act as a downloader for an XMRig cryptocurrency miner, with the malicious functionality triggering only when specific polynomial routines are called to fly under the radar.

When invoked, the backdoored functions retrieve a remote JSON configuration, download an ELF payload from 63.250.56[.]54, and execute it from memory using a memory-backed file descriptor via Linux memfd_create and /proc/self/fd to minimise on-disk traces, a technique highlighted by Kirill Boychenko in his analysis.

The campaign uses two Linux ELF binaries designed to mine cryptocurrency using XMRig, with configurations that enable CPU mining and direct the miner to Stratum over TLS endpoints on port 3333 to threat actor-controlled IP addresses. The overall Python implant functions as a general loader that can fetch and execute second-stage code under the Python process’s privileges.