Malicious Code Execution Vulnerability in semer Package
Summary
MAL-2026-18118: Malicious code in semer (PyPI). Affects semer versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The semer package, available on PyPI, is designed for specific functionalities within Python applications. However, it has been identified as a target for malicious actors due to its ability to download and execute remote code. This vulnerability poses significant risks to users who install the package without awareness of its malicious intent.
Vulnerability Detail
The vulnerability originates from the semer package, which, during installation, downloads and executes malware from a remote server. This behavior is indicative of a malicious campaign aimed at compromising user systems. The specific malicious actions include downloading an executable from a URL associated with the package, leading to potential data theft or system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall semerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, consider using alternative packages that offer similar functionalities without the associated risks. Always verify the integrity and reputation of packages before installation.
Conclusion
The semer package poses a significant security risk due to its malicious code execution vulnerability. Users are advised to uninstall the package and seek alternatives. Regular monitoring of dependencies using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for semer →
FAQ
The semer package is a Python library available on PyPI, but it has been compromised to include malicious code.
The vulnerability allows the package to download and execute malware, potentially compromising your system and data.
Immediately uninstall the semer package using 'pip uninstall semer' and check your system for any signs of compromise.
Yes, consider using other reputable packages that provide similar functionalities without the risk of malware.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in real-time using your Pipfile.lock. You can also check for vulnerabilities in your application using the Vulert playground without any signup.
