Skip to content

Python’s PyPI repository compromised by crypto-mining malware

  • by
  • 3 min read

A security researcher working for Sonatype has identified six malicious packages in the PyPI repository that can secretly run crypto miners on your machines. Ax Sharma, who initially discovered these packages found that they have been downloaded by about 5,000 people combined.

Infiltrating commonly used code repositories with such malicious packages isn’t anything new, and this isn’t the first time PyPI has been abused either. In 2016, a college student tricked about 17,000 coders into running a malicious script he posted on the repository.

Similar repos like NPM and Rubygems have also been abused with such so-called ‘typosquatting’ attacks. In such cases, the attacker duplicates a commonly used package but names it similar to the original one. If a user makes a typo while downloading these packages, they end up downloading the malicious package instead.

Can Cryptocurrency be counterfeited? Everything you need to know

In the News: Lenovo unveils 4th-gen Thinkpad X1 Extreme and 5 new gadgets

The damage done: Six packages found infected

The following six packages were found to be infected. As mentioned above, the packages were downloaded about 5000 times combined. Here’s a breakdown of their download numbers (download numbers are taken from PePy)

  • maratlib: 2,439
  • maratlib1: 388
  • matplatlib-plus: 936
  • mllearnlib: 314
  • mplatlib: 330
  • learninglib: 644

These packages were posted by someone named ‘nedog123’ on PyPI, with some packages going back as far as April this year.

The malicious code was inserted in the files of these packages and ran when the package was being installed. This caused the infected PC to either use ubqminer or T-Rex crypto miners to mine crypto and send it over to the attacker’s crypto wallet 0x510aec7f266557b7de753231820571b13eb31b57.

How were the Cryptomining packages caught?

These typosquats have a lot of heavily obfuscated code that attempted to connect to Github. Further investigation by Sharma into previous versions of the malicious package ‘maratlib’ unveiled that the code downloads and runs a Bash script from Github every time the package is installed, triggering the file. 

However, the URL servicing the Bash script was giving a 404 (not found) error. In fact, in every package version, the URL refers to the Bash script, which was called different names such as,, or wasn’t functional. 

It appeared later on that the author had switched aliases, eventually landing on ‘maratoff’, where some of the scripts were found. Upon closer inspection, one can clearly see the ubqminer mining for crypt and sending it back over the attacker’s wallet along with doing other tasks such as reporting the hash rate.

In the News: Lenovo expands its Go wireless accessories lineup


Yadullah Abidi

Yadullah is a Computer Science graduate who writes/edits/shoots/codes all things cybersecurity, gaming, and tech hardware. When he's not, he streams himself racing virtual cars. He's been writing and reporting on tech and cybersecurity with websites like Candid.Technology and MakeUseOf since 2018. You can contact him here: