{"id":"MAL-2026-18093","summary":"Malicious code in workcalender (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (9a336c0fa7a5b3ee5f036d678c8c0f0d549135a08d05549ee92cb11b1a7f78fa)\nThis package contains a stub build-time helper, which in another package of the same uploader was already turned into a backdoor installation. While this package does not yet contain malicious code, it is clear it was uploaded with such intention and likely exploits dependency confusion.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-test-workalendar-internal\n\n\nReasons (based on the campaign):\n\n\n - backdoor\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","modified":"2026-10-20T13:30:03.631651278Z","published":"2026-10-20T13:05:17Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-10-20T13:05:17.498518Z","sha256":"9a336c0fa7a5b3ee5f036d678c8c0f0d549135a08d05549ee92cb11b1a7f78fa","source":"kam193","versions":["17.1.0.dev0"],"id":"pypi/2026-10-test-workalendar-internal/workcalender","import_time":"2026-10-20T13:19:32.323344399Z"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/workcalender"}],"affected":[{"package":{"name":"workcalender","ecosystem":"PyPI","purl":"pkg:pypi/workcalender"},"versions":["17.1.0.dev0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/workcalender/MAL-2026-18093.json"}}],"schema_version":"1.9.0","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}