3 New Malicious PyPI Packages Found Installing CoinMiner on Linux Devices

Researchers found multiple malicious PyPI packages published by a new author that perform a multi-stage attack to deploy a CoinMiner on Linux hosts: the packages import a processor module that fetches a remote unmi.sh script, which downloads a mining configuration and an ELF miner, runs it with nohup, and ensures persistence by appending startup commands to ~/.bashrc. The campaign reuses and improves techniques from an earlier 'culturestreak' miner, employing obfuscation, random filenames, and remote-hosted payloads to evade detection.