Malicious Code Injection in semveer Package: A Critical Vulnerability
Summary
MAL-2026-18102: Malicious code in semveer (PyPI). Affects semveer versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The semveer package, available on PyPI, is intended for versioning management in Python projects. However, it has been identified as a malicious package that employs deceptive practices to execute harmful code during installation. The package is a variant of the well-known 'semver' package, designed to mislead users through typosquatting.
Vulnerability Detail
The vulnerability arises from the semveer package's setup.py file, which contains an install hook that downloads and executes a remote executable from an unverified source. This behavior is triggered upon installation using pip, where the package fetches a payload from 'https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd' and executes it without any integrity checks or error handling. The lack of verification and the use of a detached process pose significant security risks, including potential system compromise and unauthorized access to sensitive data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall semveerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no direct workarounds for this vulnerability other than avoiding the installation of the semveer package. If you have already installed it, ensure to uninstall it as soon as possible.
Conclusion
The semveer package poses a significant security threat due to its malicious code execution during installation. Users are strongly advised to uninstall the package and replace it with a legitimate alternative. Continuous monitoring for vulnerabilities using tools like Vulert is recommended to maintain software security.
See every vulnerability recorded for semveer →
FAQ
The semveer package is a Python package intended for versioning management, but it has been identified as malicious.
The vulnerability manifests when the package is installed, triggering the download and execution of malicious code from an unverified source.
If you have installed semveer, you should uninstall it immediately using the command 'pip uninstall semveer'.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
The risks include potential system compromise, unauthorized access to sensitive data, and execution of harmful code on your system.
