--- title: PyPI Package Impersonates SymPy to Deliver Cryptomining... description: A malicious PyPI package named sympy-dev impersonated the legitimate SymPy mathematics library, accumulating over 1,000 downloads in its first day. The package... canonical: https://daily.dev/posts/pypi-package-impersonates-sympy-to-deliver-cryptomining-malw--zo98y2sjf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PyPI Package Impersonates SymPy to Deliver Cryptomining Malw... | daily.dev og:description: A malicious PyPI package named sympy-dev impersonated the legitimate SymPy mathematics library, accumulating over 1,000 downloads in its first day. The package... og:url: https://daily.dev/posts/pypi-package-impersonates-sympy-to-deliver-cryptomining-malw--zo98y2sjf og:image: https://api.daily.dev/og/posts/zO98Y2sJF.png og:image:alt: PyPI Package Impersonates SymPy to Deliver Cryptomining Malw... og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PyPI Package Impersonates SymPy to Deliver Cryptomining Malw... **[Socket](https://daily.dev/sources/socketdev)** · 8 min read · 0 upvotes · 0 comments ## Summary A malicious PyPI package named sympy-dev impersonated the legitimate SymPy mathematics library, accumulating over 1,000 downloads in its first day. The package injected cryptomining malware into polynomial code paths that downloaded and executed XMRig miners in memory using Linux memfd_create to avoid disk artifacts. The attack used typosquatting to target SymPy's 85 million monthly downloads, with backdoored functions retrieving payloads from command and control servers. The loader architecture allows threat actors to rotate infrastructure and swap payloads without republishing, making it suitable for arbitrary code execution beyond cryptomining. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [PyPI packages are increasing rapidly](https://daily.dev/posts/pypi-packages-are-increasing-rapidly-jmpgu4wcm) · Planet Python · 0 upvotes · 0 comments - [Schneier on Security](https://daily.dev/posts/schneier-on-security-e5bm44uro) · Schneier on Security · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#malware](https://daily.dev/tags/malware), [#supply-chain](https://daily.dev/tags/supply-chain) [View this post on daily.dev](https://daily.dev/posts/pypi-package-impersonates-sympy-to-deliver-cryptomining-malw--zo98y2sjf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PyPI Package Impersonates SymPy to Deliver Cryptomining Malw...","url":"https://daily.dev/posts/pypi-package-impersonates-sympy-to-deliver-cryptomining-malw--zo98y2sjf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pypi-package-impersonates-sympy-to-deliver-cryptomining-malw--zo98y2sjf"},"datePublished":"2026-01-21T15:48:43.527Z","dateModified":"2026-02-28T04:29:54.708Z","description":"A malicious PyPI package named sympy-dev impersonated the legitimate SymPy mathematics library, accumulating over 1,000 downloads in its first day. The package...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ce3e80cca4f56df7618e84bc1d52d526?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ce3e80cca4f56df7618e84bc1d52d526?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pypi-package-impersonates-sympy-to-deliver-cryptomining-malw--zo98y2sjf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python,malware,supply-chain","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"PyPI Package Impersonates SymPy to Deliver Cryptomining Malw..."}]} ```