Poisoned Pipeline / Incidents / AS163

AS163 · 2026-03

PyPI SymPy impersonation cryptominer

PyPI

Socket: PyPI package impersonates SymPy to deliver cryptomining malware.

Mapped techniques

• T0129 Typosquatting
• T0139 Resource hijacking

supply-chain campaign

Sources

• https://socket.dev/blog/pypi-package-impersonates-sympy-to-deliver-cryptomining-malware