--- title: Malicious PyPI Package Impersonates SymPy, Deploys XMRig... description: A malicious package named sympy-dev was discovered on PyPI, impersonating the legitimate SymPy mathematics library. Downloaded over 1,100 times since January... canonical: https://daily.dev/posts/malicious-pypi-package-impersonates-sympy-deploys-xmrig-miner-on-linux-hosts-mtttpnqdr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Malicious PyPI Package Impersonates SymPy, Deploys XMRig Miner on Linux Hosts | daily.dev og:description: A malicious package named sympy-dev was discovered on PyPI, impersonating the legitimate SymPy mathematics library. Downloaded over 1,100 times since January... og:url: https://daily.dev/posts/malicious-pypi-package-impersonates-sympy-deploys-xmrig-miner-on-linux-hosts-mtttpnqdr og:image: https://api.daily.dev/og/posts/MtttPnQDR.png og:image:alt: Malicious PyPI Package Impersonates SymPy, Deploys XMRig Miner on Linux Hosts og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Malicious PyPI Package Impersonates SymPy, Deploys XMRig Miner on Linux Hosts **[The Hacker News](https://daily.dev/sources/thn)** · 2 min read · 0 upvotes · 0 comments ## Summary A malicious package named sympy-dev was discovered on PyPI, impersonating the legitimate SymPy mathematics library. Downloaded over 1,100 times since January 17, 2026, the package deploys XMRig cryptocurrency miners on Linux systems. The attack uses in-memory execution via memfd_create to avoid disk artifacts, triggering only when specific polynomial functions are called. The backdoored functions download ELF payloads from a remote server and execute them directly in memory, functioning as a general-purpose loader capable of running arbitrary code. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [A Poisoned Xinference Package Targets AI Inference Servers](https://daily.dev/posts/a-poisoned-xinference-package-targets-ai-inference-servers-qxvqxpbhu) · Security Boulevard · 1 upvotes · 0 comments - [The Hades Campaign: Graph ML PyPI Packages Deploy Cross-Platform Memory Scrapers, AI Analyst Misdirection, and a Wiper Deterrent](https://daily.dev/posts/the-hades-campaign-graph-ml-pypi-packages-deploy-cross-platform-memory-scrapers-ai-analyst-misdire-rhp4rxad7) · StepSecurity · 0 upvotes · 0 comments - [A miner with a side of RAT: the unintended gift with your TV show or book](https://daily.dev/posts/a-miner-with-a-side-of-rat-the-unintended-gift-with-your-tv-show-or-book-zxmlmohf3) · Securelist · 0 upvotes · 0 comments - [From Langflow to Monero: Inside CVE-2026-33017 Cryptominer](https://daily.dev/posts/from-langflow-to-monero-inside-cve-2026-33017-cryptominer-yaxregtae) · Trend Micro · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#linux](https://daily.dev/tags/linux), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/malicious-pypi-package-impersonates-sympy-deploys-xmrig-miner-on-linux-hosts-mtttpnqdr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious PyPI Package Impersonates SymPy, Deploys XMRig Miner on Linux Hosts","url":"https://daily.dev/posts/malicious-pypi-package-impersonates-sympy-deploys-xmrig-miner-on-linux-hosts-mtttpnqdr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/malicious-pypi-package-impersonates-sympy-deploys-xmrig-miner-on-linux-hosts-mtttpnqdr"},"datePublished":"2026-01-22T10:38:02.377Z","dateModified":"2026-03-02T23:23:24.754Z","description":"A malicious package named sympy-dev was discovered on PyPI, impersonating the legitimate SymPy mathematics library. Downloaded over 1,100 times since January...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2dd719eeb97be63dfe474f2befff7278?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2dd719eeb97be63dfe474f2befff7278?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"The Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/thn","url":"https://daily.dev/sources/thn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/malicious-pypi-package-impersonates-sympy-deploys-xmrig-miner-on-linux-hosts-mtttpnqdr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python,linux,malware","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Hacker News","item":"https://daily.dev/sources/thn"},{"@type":"ListItem","position":3,"name":"Malicious PyPI Package Impersonates SymPy, Deploys XMRig Miner on Linux Hosts"}]} ```