Malicious code in semveer (PyPI)

The 'semveer' PyPI package (version 1.0.0) contains no functional code in its module but executes malicious behavior during installation. Specifically, its setup.py install hook downloads an opaque payload from a remote URL (https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd) using urllib.request.urlretrieve, saves it to a temporary file, and launches it as a detached subprocess. This download is performed without any error reporting, hash or signature verification, and the remote host is unrelated to the declared publisher or project homepage. The package name is a one-character variation of the popular 'semver' package, consistent with typosquatting tactics designed to trick users into installing malware.

Installing this package results in the silent download and execution of a remote payload, which is malware. This can lead to compromise of the user's system, data theft, or other malicious activities depending on the payload. The lack of verification and error suppression increases the risk of successful exploitation.

Avoid installing the 'semveer' package. Verify package names carefully to avoid typosquatting traps. Since no official fix or patch is available, users should uninstall this package if installed and rely on trusted sources. Use package signing and verification tools where possible to detect tampered or malicious packages.