A fake sympy-dev package on PyPI impersonates the SymPy library to download and run XMRig cryptominers on Linux using in-memory execution.

The Tidyverse Blog offers insights, tutorials, and updates on the Tidyverse, a collection of R packages for data science and statistical computing. Covering topics such as data manipulation, visualization, and analysis, the blog provides resources for R developers looking to leverage the power of the Tidyverse for their data projects. Developers can learn how to use Tidyverse packages effectively to clean, transform, and analyze data in R.

The Hacker News

A malicious package named sympy-dev was discovered on PyPI, impersonating the legitimate SymPy mathematics library. Downloaded over 1,100 times since January 17, 2026, the package deploys XMRig cryptocurrency miners on Linux systems. The attack uses in-memory execution via memfd_create to avoid disk artifacts, triggering only when specific polynomial functions are called. The backdoored functions download ELF payloads from a remote server and execute them directly in memory, functioning as a general-purpose loader capable of running arbitrary code.

Malicious PyPI Package Impersonates SymPy, Deploys XMRig Miner on Linux Hosts