{"id":"MAL-2026-18101","summary":"Malicious code in semmver (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8de323d5976a26f2d9540680d1706a53bcb3ca743409821e83f7a2f1b60e8594)\nThe package is a typosquat-style empty stub (semmver/__init__.py contains only __version__ = '1.0.0') whose only functional code is in setup.py. At pip install time, setup.py calls urllib.request.urlretrieve to download an opaque, unpinned binary from https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd, writes it to a temporary path, and launches it via subprocess.Popen with start_new_session=True and stdout/stderr suppressed, detaching it from the installer process. There is no hash or signature verification, no pinning, and the destination host is unrelated to any legitimate utility purpose; the subdomain is self-labeled 'c2-worker'. Installing this package executes attacker-controlled code on the installer's machine.\n\n## Source: kam193 (7b4ffebc6fe59fc1db7154c0a7ed9e6788d6a27ccea81fe1f4df432578b2c4d6)\nDuring installation, package downloads and executes malware.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-semvver\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - malware\n\n\n - typosquatting\n","modified":"2026-10-20T19:30:08.005669568Z","published":"2026-10-20T18:20:25Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-20T18:22:19.796812316Z","modified_time":"2026-10-20T18:20:25Z","sha256":"8de323d5976a26f2d9540680d1706a53bcb3ca743409821e83f7a2f1b60e8594","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-021535"},{"modified_time":"2026-10-20T18:27:48.933872Z","sha256":"7b4ffebc6fe59fc1db7154c0a7ed9e6788d6a27ccea81fe1f4df432578b2c4d6","source":"kam193","versions":["1.0.0"],"id":"pypi/2026-10-semvver/semmver","import_time":"2026-10-20T19:15:26.392353807Z"}],"iocs":{"domains":["c2-worker.crawlnet-claim.workers.dev"],"urls":["https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd"]}},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/semmver/1.0.0/"},{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7/"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/semmver"}],"affected":[{"package":{"name":"semmver","ecosystem":"PyPI","purl":"pkg:pypi/semmver"},"versions":["1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"6d8e5c8ebfa03728ee38c5369948474c27f02ecf99a77fc1874f37226feadee3","tlsh":"15f0c052c617672182c29231ee2204622ff79603db83d8f1359c53945fcd8768114a09"},{"sha256":"46c663463329acd7039bdef0a9145293aad32e04d7f0dd06ca2719c99f0eb014","path":"semmver/__init__.py"}],"package_integrity":[{"filename":"semmver-1.0.0.tar.gz","hashes":{"md5":"c390bd33ed111729b206e64b88678372","sha256":"cd78094374ea086395fc0671db68774068ee16e944ae5a2ad5527f6468869a1d","blake2b_256":"0092ddfa390fca0d99fbe85e1ba8f249fbb4591ec316a4573c77ca3eefde7754"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/semmver/MAL-2026-18101.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}