GCVE-110-OSM-2026-14110

This package contains a stub build-time helper, which in another package of the same uploader was already turned into a backdoor installation. While this package does not yet contain malicious code, it is clear it was uploaded with such intention and likely exploits dependency confusion. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-test-workalendar-internal Reasons (based on the campaign): - backdoor - The package overrides the install command in setup.py to execute malicious code during installation. ENTRY src/workcalender/__main__.py (console-script: workcalender=workcalender.__main__:main)