Malicious code in semvver (PyPI)

The semvver PyPI package version 1.0.0 includes a setup.py script that performs an unverified fetch-and-execute operation during installation. It downloads a binary named 'pyupd' from an unrelated Cloudflare Workers subdomain and executes it detached from the installation process. This behavior allows whoever controls the remote endpoint to execute arbitrary code on the host machine persistently. The package contains no other functional code, confirming its sole purpose is to deliver malware. This is a classic install-time dropper using typosquatting to trick users into installing malicious software.

Installation of semvver version 1.0.0 results in arbitrary code execution on the installer's host system, potentially allowing persistent malware infection. The malicious payload runs detached from the installation process, evading immediate detection and enabling ongoing control by the attacker. This compromises system integrity and security.

No official patch or remediation is currently available. Users should avoid installing the semvver package version 1.0.0 from PyPI. Verify package authenticity before installation and prefer well-known, trusted packages. Monitor for updates from PyPI or the package maintainer regarding removal or remediation.