MAL-2026-18101

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/semmver/MAL-2026-18101.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18101
Published
2026-10-20T18:20:25Z
Modified
2026-10-20T19:30:08Z
Summary
Malicious code in semmver (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8de323d5976a26f2d9540680d1706a53bcb3ca743409821e83f7a2f1b60e8594)

The package is a typosquat-style empty stub (semmver/init.py contains only version = '1.0.0') whose only functional code is in setup.py. At pip install time, setup.py calls urllib.request.urlretrieve to download an opaque, unpinned binary from https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd, writes it to a temporary path, and launches it via subprocess.Popen with start_new_session=True and stdout/stderr suppressed, detaching it from the installer process. There is no hash or signature verification, no pinning, and the destination host is unrelated to any legitimate utility purpose; the subdomain is self-labeled 'c2-worker'. Installing this package executes attacker-controlled code on the installer's machine.

Source: kam193 (7b4ffebc6fe59fc1db7154c0a7ed9e6788d6a27ccea81fe1f4df432578b2c4d6)

During installation, package downloads and executes malware.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-semvver

Reasons (based on the campaign):

  • Downloads and executes a remote executable.

  • malware

  • typosquatting

Database specific 
{
    "iocs":  {
        "domains":  [
            "c2-worker.crawlnet-claim.workers.dev"
        ],
        "urls":  [
            "https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021535",
            "import_time":  "2026-10-20T18:22:19.796812316Z",
            "modified_time":  "2026-10-20T18:20:25Z",
            "sha256":  "8de323d5976a26f2d9540680d1706a53bcb3ca743409821e83f7a2f1b60e8594",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "pypi/2026-10-semvver/semmver",
            "import_time":  "2026-10-20T19:15:26.392353807Z",
            "modified_time":  "2026-10-20T18:27:48.933872Z",
            "sha256":  "7b4ffebc6fe59fc1db7154c0a7ed9e6788d6a27ccea81fe1f4df432578b2c4d6",
            "source":  "kam193",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / semmver

Package

Name
semmver
View open source insights on deps.dev
Purl
pkg:pypi/semmver

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "setup.py",
            "sha256":  "6d8e5c8ebfa03728ee38c5369948474c27f02ecf99a77fc1874f37226feadee3",
            "tlsh":  "15f0c052c617672182c29231ee2204622ff79603db83d8f1359c53945fcd8768114a09"
        },
        {
            "path":  "semmver/__init__.py",
            "sha256":  "46c663463329acd7039bdef0a9145293aad32e04d7f0dd06ca2719c99f0eb014"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "semmver-1.0.0.tar.gz",
            "hashes":  {
                "blake2b_256":  "0092ddfa390fca0d99fbe85e1ba8f249fbb4591ec316a4573c77ca3eefde7754",
                "md5":  "c390bd33ed111729b206e64b88678372",
                "sha256":  "cd78094374ea086395fc0671db68774068ee16e944ae5a2ad5527f6468869a1d"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/semmver/MAL-2026-18101.json"