Beware: 3 Malicious PyPI Packages Found Targeting Linux with Crypto Miners

Three malicious Python packages (modularseven, driftme, catme) published to PyPI were discovered to deploy a CoinMiner on Linux systems. The packages decode and fetch a first-stage shell script that retrieves configuration and an ELF miner hosted remotely (GitLab and papiculo.net), execute the binary with nohup to run in the background, and ensure persistence by inserting commands into ~/.bashrc; they attracted 431 downloads before takedown and show code reuse and staging techniques similar to a prior culturestreak campaign.