The PyPI package 'workcalender' version 17.1.0.dev0 is identified as malicious due to its overridden install command in setup.py that executes malicious code during installation. Although no installer-side harm such as network I/O, credential scraping, or persistence mechanisms were observed, the package appears to be a developmental release uploaded with intent to exploit dependency confusion. This package is part of a campaign with clear malicious intent, including backdoor installation.