MAL-2026-18093

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/workcalender/MAL-2026-18093.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18093
Published
2026-10-20T13:05:17Z
Modified
2026-10-29T14:45:12Z
Summary
Malicious code in workcalender (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e6a50d22163d9cc8d0eda40abaaa32d88d5c8657ce914ba8b8c792a16cb5ca58)

Analysis of the package's shipped files produced no indicators of installer-side harm: no install-time or import-time network I/O, no credential or environment scraping, no fetch-and-execute pattern, no lifecycle shell execution, no silent relay of caller data to a hardcoded destination, and no persistence or backdoor mechanism. The package appears to be a small or developmental release with no observable supply-chain attack surface.

Source: kam193 (9a336c0fa7a5b3ee5f036d678c8c0f0d549135a08d05549ee92cb11b1a7f78fa)

This package contains a stub build-time helper, which in another package of the same uploader was already turned into a backdoor installation. While this package does not yet contain malicious code, it is clear it was uploaded with such intention and likely exploits dependency confusion.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-test-workalendar-internal

Reasons (based on the campaign):

  • backdoor

  • The package overrides the install command in setup.py to execute malicious code during installation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-test-workalendar-internal/workcalender",
            "import_time": "2026-10-20T13:19:32.323344399Z",
            "modified_time": "2026-10-20T13:05:17.498518Z",
            "sha256": "9a336c0fa7a5b3ee5f036d678c8c0f0d549135a08d05549ee92cb11b1a7f78fa",
            "source": "kam193",
            "versions": [
                "17.1.0.dev0"
            ]
        },
        {
            "id": "IN-MAL-2026-022343",
            "import_time": "2026-10-29T14:37:05.019562481Z",
            "modified_time": "2026-10-29T14:20:35Z",
            "sha256": "e6a50d22163d9cc8d0eda40abaaa32d88d5c8657ce914ba8b8c792a16cb5ca58",
            "source": "amazon-inspector",
            "versions": [
                "17.1.0.dev0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / workcalender

Package

Name
workcalender
View open source insights on deps.dev
Purl
pkg:pypi/workcalender

Affected ranges

Affected versions

17.*
17.1.0.dev0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "workcalender-17.1.0.dev0.tar.gz",
            "hashes": {
                "blake2b_256": "3863286eacba4343efc8f2d1e4abca0cb3d7b92f0f99f9c46646abb126393a2c",
                "md5": "16ed71e724da36665070755ba2586acb",
                "sha256": "1665642c42112fb056c74cb8291a93fc994805f578277b9e6db2e2145079c8f6"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/workcalender/MAL-2026-18093.json"