“SymPy” Imposter: Typosquatting Attack Turns Math Library into Crypto Miner

A malicious typosquatted PyPI package named "sympy-dev" impersonated the popular SymPy library to deliver a staged downloader that fetches and executes an ELF payload (observed as XMRig) in-memory using memfd_create, evading disk-based detection; the package saw over 1,000 downloads on its first day (published 2026-01-17) and researchers warn the chain enables arbitrary code execution and reuse for other payloads, recommending dependency pinning and integrity checks.