{"items":[{"id":"NVI-00008444","kind":"supply_chain_event","title":"Malicious code in semveer (PyPI)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xh78-qp67-j6mg"],"plain_summary":"GitHub lists this malware advisory for semveer. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2fd0f65f7192861a31d13c7e2986f3e0"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2fd0f65f7192861a31d13c7e2986f3e0","url":"https://github.com/advisories/GHSA-xh78-qp67-j6mg","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xh78-qp67-j6mg","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:57:08.488Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2fd0f65f7192861a31d13c7e2986f3e0"],"technology":"semveer","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (d86237b957fd063a0e1fcf250a510b2fb9566ab48652e56fe787d2e1a02e351a)\nThe sdist for 'semveer' ships an inert module (semveer/__init__.py contains only a __version__ stub) and places all runtime behavior inside setup.py's install hook. On pip install, setup.py calls urllib.request.urlretrieve against https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd, writes the opaque payload to a temporary file, and launches it via subprocess.Popen with start_new_session=True as a detached process. The fetch is wrapped in a bare try/except that suppresses errors, there is no hash or signature verification, the version is not pinned, and the destination host is unrelated to any declared publisher or project homepage. The package name is a one-character edit of the widely used 'semver' name, consistent with a typosquat lure whose only purpose is to trigger the install-time dropper.\n\n---\n\nCredit: OpenSSF (source)","public_affected_ranges":["= 1.0.0"]}],"null_published_at":"2026-10-31T22:13:22.846Z","source_updated_at":"2026-10-23T00:33:39.000Z","source_disclosed_at":"2026-10-20T18:31:30.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:57:08.488Z"}],"next_cursor":null,"snapshot_revision":"42594"}