Malicious code in semverr (PyPI)

The semverr package is a near-empty Python package whose setup.py script, executed during installation, downloads a remote binary from an untrusted Cloudflare Workers URL without verification. This binary is saved to a temporary file and launched as a detached subprocess with output suppressed, allowing the malware to run silently. The package name mimics the popular semver library, indicating a typosquatting attack. The installation process swallows exceptions to avoid alerting the user to the malicious activity. The package contains no other functionality beyond this malicious behavior.

Installing the semverr package results in silent execution of a remote binary that is malware. This can lead to compromise of the host system, unauthorized code execution, and potential further malicious activity depending on the payload of the downloaded binary. The package is designed to evade detection and runs without user awareness.

Do not install the semverr package. Use official and verified packages from trusted sources. Since no patch or fix exists for this malicious package, avoid it entirely. Security teams should monitor for attempts to install this package and block it in package management systems. Verify package authenticity and integrity before installation.