Malicious Code Execution Vulnerability in semverr Package
Summary
MAL-2026-18103: Malicious code in semverr (PyPI). Affects semverr versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The semverr package is a minimalistic Python package that primarily serves to define a version number. However, it is a near-empty package that closely resembles the popular semver library, which can mislead users. This package has been identified as malicious due to its setup.py file that executes harmful code during installation.
Vulnerability Detail
The vulnerability originates from the semverr package's setup.py, which executes malicious code upon installation. It uses urllib.request.urlretrieve to download a binary from an unverified source and executes it silently. This poses a significant risk as it can lead to unauthorized code execution on the user's system, potentially compromising sensitive data and system integrity. The fetch operation is unpinned and unverified, meaning there are no checks for the integrity or authenticity of the downloaded file, making it susceptible to exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall semverrIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no specific workarounds available for this vulnerability other than uninstalling the semverr package. If you need similar functionality, consider using the legitimate semver library instead.
Conclusion
The semverr package poses a significant security risk due to its malicious code execution during installation. Users are advised to uninstall this package immediately and consider using safer alternatives. Continuous monitoring for vulnerabilities, such as using Vulert, can help maintain the security of your applications.
See every vulnerability recorded for semverr →
FAQ
The semverr package is a minimalistic Python package that defines a version number but has been identified as malicious due to its harmful installation behavior.
The vulnerability manifests during the installation process when the setup.py file executes malicious code that downloads and runs an unverified binary.
The risks include unauthorized code execution, potential data breaches, and compromise of system integrity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, you can use the legitimate semver library, which provides similar functionality without the associated risks.
