If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (e6a50d22163d9cc8d0eda40abaaa32d88d5c8657ce914ba8b8c792a16cb5ca58)
Analysis of the package's shipped files produced no indicators of installer-side harm: no install-time or import-time network I/O, no credential or environment scraping, no fetch-and-execute pattern, no lifecycle shell execution, no silent relay of caller data to a hardcoded destination, and no persistence or backdoor mechanism. The package appears to be a small or developmental release with no observable supply-chain attack surface.
Source: kam193 (9a336c0fa7a5b3ee5f036d678c8c0f0d549135a08d05549ee92cb11b1a7f78fa)
This package contains a stub build-time helper, which in another package of the same uploader was already turned into a backdoor installation. While this package does not yet contain malicious code, it is clear it was uploaded with such intention and likely exploits dependency confusion.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-test-workalendar-internal
Reasons (based on the campaign):
- backdoor
- The package overrides the install command in setup.py to execute malicious code during installation.