{"id":"MAL-2026-18101","title":"Malicious code in semmver (PyPI)","summary":"Malicious code in semmver (PyPI)","severity":"critical","exploited":true,"vendor":"semmver","product":"semmver","ecosystem":"pip","affected":["semmver"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T19:30:08.005669568Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18101","references":[{"url":"https://pypi.org/project/semmver/1.0.0/"},{"url":"https://www.virustotal.com/gui/file/e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7/"},{"url":"https://bad-packages.kam193.eu/pypi/package/semmver"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-10-21T11:54:42.741Z","slug":"MAL-2026-18101","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8de323d5976a26f2d9540680d1706a53bcb3ca743409821e83f7a2f1b60e8594)\nThe package is a typosquat-style empty stub (semmver/__init__.py contains only __version__ = '1.0.0') whose only functional code is in setup.py. At pip install time, setup.py calls urllib.request.urlretrieve to download an opaque, unpinned binary from https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd, writes it to a temporary path, and launches it via subprocess.Popen with start_new_session=True and stdout/stderr suppressed, detaching it from the installer process. There is no hash or signature verification, no pinning, and the destination host is unrelated to any legitimate utility purpose; the subdomain is self-labeled 'c2-worker'. Installing this package executes attacker-controlled code on the installer's machine.\n\n## Source: kam193 (7b4ffebc6fe59fc1db7154c0a7ed9e6788d6a27ccea81fe1f4df432578b2c4d6)\nDuring installation, package downloads and executes malware.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-semvver\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - malware\n\n\n - typosquatting\n\n\n## Affected packages\n\n- `semmver`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[]}