workcalender

{"schema_version":"1.7.4","id":"MAL-2026-18093","published":"2026-10-20T13:05:17Z","modified":"2026-10-29T14:38:27.864230549Z","summary":"Malicious code in workcalender (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e6a50d22163d9cc8d0eda40abaaa32d88d5c8657ce914ba8b8c792a16cb5ca58)\nAnalysis of the package's shipped files produced no indicators of installer-side harm: no install-time or import-time network I/O, no credential or environment scraping, no fetch-and-execute pattern, no lifecycle shell execution, no silent relay of caller data to a hardcoded destination, and no persistence or backdoor mechanism. The package appears to be a small or developmental release with no observable supply-chain attack surface.\n\n## Source: kam193 (9a336c0fa7a5b3ee5f036d678c8c0f0d549135a08d05549ee92cb11b1a7f78fa)\nThis package contains a stub build-time helper, which in another package of the same uploader was already turned into a backdoor installation. While this package does not yet contain malicious code, it is clear it was uploaded with such intention and likely exploits dependency confusion.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-test-workalendar-internal\n\n\nReasons (based on the campaign):\n\n\n - backdoor\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"workcalender","ecosystem":"PyPI"},"versions":["17.1.0.dev0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"workcalender-17.1.0.dev0.tar.gz","hashes":{"blake2b_256":"3863286eacba4343efc8f2d1e4abca0cb3d7b92f0f99f9c46646abb126393a2c","md5":"16ed71e724da36665070755ba2586acb","sha256":"1665642c42112fb056c74cb8291a93fc994805f578277b9e6db2e2145079c8f6"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/workcalender"},{"type":"PACKAGE","url":"https://pypi.org/project/workcalender/17.1.0.dev0/"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-test-workalendar-internal/workcalender","import_time":"2026-10-20T13:19:32.323344399Z","modified_time":"2026-10-20T13:05:17.498518Z","sha256":"9a336c0fa7a5b3ee5f036d678c8c0f0d549135a08d05549ee92cb11b1a7f78fa","source":"kam193","versions":["17.1.0.dev0"]},{"id":"IN-MAL-2026-022343","import_time":"2026-10-29T14:37:05.019562481Z","modified_time":"2026-10-29T14:20:35Z","sha256":"e6a50d22163d9cc8d0eda40abaaa32d88d5c8657ce914ba8b8c792a16cb5ca58","source":"amazon-inspector","versions":["17.1.0.dev0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}