Malicious code in semmver (PyPI)

{
  "id": "f852164a8b7f62020911c4050b952faa805457ecdd5afe67375233349f3f9229",
  "url": "https://osv.dev/vulnerability/MAL-2026-18101",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in semmver (PyPI)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8de323d5976a26f2d9540680d1706a53bcb3ca743409821e83f7a2f1b60e8594) The package is a typosquat-style empty stub (semmver/__init__.py contains only __version__ = '1.0.0') whose only functional code is in setup.py. At pip install time, setup.py calls urllib.request.urlretrieve to download an opaque, unpinned binary from https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd, writes it to a temporary path, and launches it via subprocess.Popen with start_new_session=True and stdout/stderr suppressed, detaching it from the installer process. There is no hash or signature verification, no pinning, and the destination host is unrelated to any legitimate utility purpose; the subdomain is self-labeled 'c2-worker'. Installing this package executes attacker-controlled code on the installer's machine. ## Source: kam193 (7b4ffebc6fe59fc1db7154c0a7ed9e6788d6a27ccea81fe1f4df432578b2c4d6) During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-semvver Reasons (based on the campaign): - Downloads and executes a remote executable. - malware - typosquatting",
    "evidence": "osv:MAL-2026-18101",
    "products": [
      {
        "name": {
          "value": "semmver",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-18101",
      "aliases": [
        "MAL-2026-18101"
      ],
      "affected": [
        {
          "package": {
            "name": "semmver",
            "purl": "pkg:pypi/semmver",
            "ecosystem": "PyPI"
          },
          "versions": [
            "1.0.0"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/semmver/MAL-2026-18101.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "setup.py",
                  "tlsh": "15f0c052c617672182c29231ee2204622ff79603db83d8f1359c53945fcd8768114a09",
                  "sha256": "6d8e5c8ebfa03728ee38c5369948474c27f02ecf99a77fc1874f37226feadee3"
                },
                {
                  "path": "semmver/__init__.py",
                  "sha256": "46c663463329acd7039bdef0a9145293aad32e04d7f0dd06ca2719c99f0eb014"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "md5": "c390bd33ed111729b206e64b88678372",
                    "sha256": "cd78094374ea086395fc0671db68774068ee16e944ae5a2ad5527f6468869a1d",
                    "blake2b_256": "0092ddfa390fca0d99fbe85e1ba8f249fbb4591ec316a4573c77ca3eefde7754"
                  },
                  "filename": "semmver-1.0.0.tar.gz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-22T23:45:03.529824306Z",
      "provider": "osv",
      "references": [
        "https://pypi.org/project/semmver/1.0.0/",
        "https://www.virustotal.com/gui/file/e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7/",
        "https://bad-packages.kam193.eu/pypi/package/semmver"
      ],
      "provider_metadata": {
        "iocs": {
          "urls": [
            "https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd"
          ],
          "domains": [
            "c2-worker.crawlnet-claim.workers.dev"
          ]
        },
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-021535",
            "sha256": "8de323d5976a26f2d9540680d1706a53bcb3ca743409821e83f7a2f1b60e8594",
            "source": "amazon-inspector",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-10-20T18:22:19.796812316Z",
            "modified_time": "2026-10-20T18:20:25Z"
          },
          {
            "id": "pypi/2026-10-semvver/semmver",
            "sha256": "7b4ffebc6fe59fc1db7154c0a7ed9e6788d6a27ccea81fe1f4df432578b2c4d6",
            "source": "kam193",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-10-20T19:15:26.392353807Z",
            "modified_time": "2026-10-20T18:27:48.933872Z"
          },
          {
            "id": "pypi/2026-10-semvver/semmver",
            "sha256": "bce2aae5f62ef8d2102cc3e9182df7370bffda2bed4074a967a94b8127ca3bde",
            "source": "kam193",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-10-22T23:38:53.988602405Z",
            "modified_time": "2026-10-20T18:27:48.933872Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 410155,
  "published_at": "2026-10-20T18:20:25+00:00"
}