Miner Virus Risk? (probably unrelated, but everyone please report if you also got it)

[rachel-sunrui]

Hi,

After I installed the package, a malicious process appeared on the system. It is running 100% on all GPUs and will restart after I killed it. I am wondering if other people have mention this to you, especially after your recent update ?

Thank you.

[peci1]

That's weird... How did you install it? Using pip?

[peci1]

especially after your recent update

What update do you mean? There hasn't been any source update since August '21 and no Pypi release since May '21.

[rachel-sunrui]

Thanks for your quick response. Yes. pip3 install nvidia-htop

I just wanna double check if you heard anyone having the same issue recently. I know nothing about these miner processes. I honestly have no idea why this is happening. I noticed this systemmd (double m, not systemd) running on root about 5 mins after I ran pip install. I am just trying to gather more information here.

[peci1]

No, you're the first one reporting this issue. As there hasn't been any update of this package for almost a year, it is not probable that the package itself would be the source of problems. I see much more probable your pip got hacked.

What's the output of which pip3 (or sudo which pip3 if you installed with sudo)?

[rachel-sunrui]

The normal

/usr/local/anaconda3/bin/pip3

I did not use sudo.

[peci1]

That looks ok (unless some virus changed the contents of that file).

There is a similar report from 1 year ago: https://www.reddit.com/r/Ubuntu/comments/k6vmg7/systemmd_process_using_cuda_and_4gb_of_gpu_memory/ . Can you also try to figure out where is the systemmd file located and who launches it?

[peci1]

Please also try running:

pip3 install --download-cache="/tmp/download" nvidia-htop

and compare hashes of the downloaded files with those from https://pypi.org/project/nvidia-htop/#files .

[peci1]

Also, the only dependency this program has is termcolor, which had its last release in 2011. termcolor itself has no dependencies. So it should also not be possible that one of the dependencies got hijacked.

[rachel-sunrui]

I also found the reddit post. (and another post posted by the same person.) Those suggestions did not help.

Thank you for all the suggestions. I will look into those. Thank you for your time and help. I do not think this is related to nvidia-htop either. (thx for the wonderful tool, btw) I will see if I can find someone who knows more about these kinds of miner processes, and I will let you know if I have any related updates.

[peci1]

Okay. Let me know if you find something related. I'll leave this issue open for one more month so that people can see it, and if nobody else joins the discussion, I'll close it afterwards.

[peci1]

I'm closing this issue. Feel free to drop a comment if you get any new insights.