workcalender@17.1.0.dev0

Summary

This package contains a stub build-time helper, which in another package of the same uploader was already turned into a backdoor installation. While this package does not yet contain malicious code, it is clear it was uploaded with such intention and likely exploits dependency confusion. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-test-workalendar-internal Reasons (based on the campaign): - backdoor - The package overrides the install command in setup.py to execute malicious code during installation.

Source: kam193 (9a336c0fa7a5b3ee5f036d678c8c0f0d549135a08d05549ee92cb11b1a7f78fa)