The Python Package Index (PyPI) has been found to be home to multiple malicious packages including a malicious package that impersonates the widely popular package SymPy, which is primarily considered to be used for symbolic mathematics by many developers.
However, this particular package named "sympy-dev" was published on January 17th 2026 and has been downloaded over 1,100 times; as of the writing of this article the package is still available on PyPI, meaning that there is at least some indication that developers have downloaded and unknowingly installed the "sympy-dev" package.
How does this Package Work?
An analysis of the sympy-dev package by the Cybersecurity company Socket, showed that this package attempts to trick developers into downloading a version of SymPy that contains backdoor access. The backdoor functions modify legitimate SymPy functions to hide the maliciousness of the backdoor until certain polynomial routines are called when the backdoor is triggered.
When triggered, the backdoor functions will complete the following tasks:
1. Retrieve a remote json configuration from the attacker’s server,
2. Download a Linux ELF payload from the attacker’s server,
3. Execute the payload directly from memory, using memory file descriptors without writing any file to disk.
The attacker uses memfd_create and /proc/self/fd functions to accomplish the above tasks, which significantly limit the amount of forensic evidence left in the system to prove that a backdoor has been installed in the developer’s system.
Cryptocurrency Mining: Detection by First Payload
The mining payload was downloaded from IP address 63.250.56[.]54, and actually refers to the executable files in Linux format called ELF and are set up to run XMRig , which is an established cryptocurrency miner.
Both of these configurations have:
1. The capability to work with CPU mining
2. Disabling of back end uses of GPU cards
3. Established ports 3333 with TLS connections to Stratum servers for mining
These techniques for executing within the memory of the system match what has been seen before with groups performing crypto-jacking as happened in the case of FritzFrog and Mimo.
Why This Is More Than Cryptomining
Although this campaign deploys a crypto miner, researchers warn that the Python implant itself is generic.
Due to the same functionality available to an attacker due to using the same technique, it is reasonable for an attacker to:
1. Use this technique to install backdoor applications.
2. Use this technique to deploy applications that steal credentials.
3. Use this technique to utilize tools to gain lateral movement
All of these attacks can be performed using the same level of privileges as the Python process; this makes developers and CI/CD users prime targets.
For Developers:
This attack shows that supply chain attacks can be quite sophisticated. In addition to the often familiar name of a package, a lot of the same text as the original package can be found on a public site, and a delay between the actual execution and the attack can make it easy to miss it during a review.
Developers using Python primarily on Linux systems should:
1. Verify that they have the correct package names.
2. Be cautious of using packages labelled "dev" or "unofficial".
3. Monitor for outbound network traffic from their development environments.
After importing a compromised package, it is often too late to mitigate the damage caused.
Source: The Hacker News
