{"id":"MAL-2026-18119","title":"Malicious code in ssemver (PyPI)","summary":"Malicious code in ssemver (PyPI)","severity":"critical","exploited":true,"vendor":"ssemver","product":"ssemver","ecosystem":"pip","affected":["ssemver"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T23:45:07.229408563Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18119","references":[{"url":"https://www.virustotal.com/gui/file/e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7/"},{"url":"https://bad-packages.kam193.eu/pypi/package/ssemver"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-10-21T11:54:42.745Z","slug":"MAL-2026-18119","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (6aacc4af4fb66d334fa0153d79a707cf0c3decfe3d3b7ed41c67697f21d8b16b)\nDuring installation, package downloads and executes malware.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-semvver\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - malware\n\n\n - typosquatting\n\n\n## Affected packages\n\n- `ssemver`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[]}