MAL-2026-18093 Malicious code in workcalender (PyPI)

Analysis of the package's shipped files produced no indicators of installer-side harm: no install-time or import-time network I/O, no credential or environment scraping, no fetch-and-execute pattern, no lifecycle shell execution, no silent relay of caller data to a hardcoded destination, and no persistence or backdoor mechanism. The package appears to be a small or developmental release with no observable supply-chain attack surface.

This package contains a stub build-time helper, which in another package of the same uploader was already turned into a backdoor installation. While this package does not yet contain malicious code, it is clear it was uploaded with such intention and likely exploits dependency confusion.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-test-workalendar-internal

Reasons (based on the campaign):

• backdoor

• The package overrides the install command in setup.py to execute malicious code during installation.