# sympy-dev PyPI typosquat delivering XMRig cryptominer

> A PyPI typosquat of SymPy was published by the account "Nanit" across four versions on Jan 17, 2026. It fetches a remote JSON config, downloads an ELF, and executes it from a memfd to evade disk-based detection. The payload is XMRig mining Monero on infected developer workstations.

- Published: 2026-01-17
- Severity: high
- Kind: Typosquat - A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK.
- Ecosystems: PyPI
- Scope: 1 package, 4 compromised versions
- Tags: typosquat, obfuscation, cryptominer
- Detected by: Socket
- Incident ID: pypi-2026-01-17-sympy-dev-miner

## Affected packages (1)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [sympy-dev](https://dependencywatch.io/package/pypi/sympy-dev) | PyPI | 1.2.3, 1.2.4, 1.2.5, 1.2.6 |

## What happened

On January 17, 2026 a PyPI publisher operating as `Nanit` pushed four versions of `sympy-dev` (1.2.3 through 1.2.6), a typosquat of the real `sympy` symbolic-math library. The package was advertised as a development snapshot and reached PyPI's normal search results before Socket flagged it.

The loader fetches a remote JSON config, pulls down a Linux ELF binary, and executes it via `memfd_create` so the payload never touches disk. The binary is XMRig, a Monero cryptominer, configured to mine to wallets controlled by the publisher.

Resource theft is the headline impact, but the technique - in-memory ELF execution to defeat file-based EDR - is the more useful indicator for defenders. CI runners that resolved the typosquat will show unexplained outbound traffic to `63.250.56.54` and `185.167.99.46`, plus `memfd:` entries in `/proc/*/maps` on Linux. The real package is `sympy` (no suffix); audit `requirements.txt` and `pyproject.toml` for `sympy-dev` anywhere.

## Impact

- In-memory ELF execution via memfd_create bypasses file-based EDR
- Compromised developer hosts mine Monero for the attacker
- Resource theft on CI runners that resolved the typosquat

## What to do

1. Remove sympy-dev wherever installed; the real package is `sympy`
2. Hunt for outbound traffic to 63.250.56.54 and 185.167.99.46
3. Check for unexpected memfd-backed processes on Linux build hosts

## Check your own dependencies

- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [Socket: PyPI package impersonates SymPy](https://socket.dev/blog/pypi-package-impersonates-sympy-to-deliver-cryptomining-malware) - Socket

---

Canonical page: https://dependencywatch.io/incident/pypi-2026-01-17-sympy-dev-miner
Markdown version: https://dependencywatch.io/incident/pypi-2026-01-17-sympy-dev-miner.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).