Malicious code in semmver (PyPI)

The semmver PyPI package (version 1.0.0) is a typosquatting stub that contains minimal legitimate code but executes malicious actions during installation. Specifically, its setup.py script downloads an opaque binary from a suspicious domain labeled 'c2-worker' and executes it without any integrity checks or pinning. This results in arbitrary code execution on the system of anyone installing the package. The package is designed to masquerade as a legitimate utility but is in fact a malware delivery mechanism.

Installing the semmver package version 1.0.0 results in execution of attacker-controlled code on the installer's machine. This can lead to compromise of the system, including potential installation of malware or other malicious activities. The lack of verification for the downloaded binary increases the risk of infection.

Avoid installing the semmver package version 1.0.0 from PyPI. Since this is a malicious typosquatting package, the best mitigation is to verify package names carefully before installation. There is no official fix or patch available. Users should remove the package if installed and scan their systems for potential compromise.