workcalender (PyPI) · Malicious Code
Affects workcalenderSource GCVE Database
Malicious package : remove workcalender and rotate any secrets on hosts that installed it.
Data as of 29 Oct 2026, 17:39 UTC
Malicious package
Published to PyPI · OSV MAL-2026-18093
What to do
Remove workcalender from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIworkcalender | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The PyPI package 'workcalender' version 17.1.0.dev0 is identified as malicious due to its overridden install command in setup.py that executes malicious code during installation. Although no installer-side harm such as network I/O, credential scraping, or persistence mechanisms were observed, the package appears to be a developmental release uploaded with intent to exploit dependency confusion. This package is part of a campaign with clear malicious intent, including backdoor installation.