pycalendar-api

GHSA-xjcv-h5jg-rx3r

Malicious code in pycalendar-api (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.4.0`

## Source: amazon-inspector (bda873c38a1eee9ecea320371b0473466144f2bd41bc778dff8510cb5dcf4b5f)
pyproject.toml line 8 declares `httpxyz` as a runtime dependency (`dependencies = ['httpxyz',...]`), and `pycalendar_api/utils/http_client.py` imports `httpxyz` and exercises an API surface (`httpxyz.Client`, `httpxyz.AsyncClient`, `httpxyz.Timeout`, `httpxyz.HTTPTransport`, `httpxyz.AsyncHTTPTransport`, `event_hooks`) that is byte-identical to the well-known `httpx` HTTP client. `httpxyz` is not a recognized mainstream PyPI package; the name is a clear typosquat of `httpx`, and the README links to a non-canonical `https://httpxyz.org`. Any `pip install pycalendar-api` will resolve and install whatever package owns the name `httpxyz` on PyPI onto the installer's machine — a silent transitive that the installer never asked for and that mimics a legitimate library. This is the namespace-abuse / dependency-confusion shape: the lure package uses a typosquat name as a hard dependency to drag attacker-controlled (or attacker-claimable) code into every installer's environment, while presenting a legitimate-looking API.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/pycalendar-api/MAL-2026-4764.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/pycalendar-api/MAL-2026-4764.json
- https://pypi.org/project/pycalendar-api/0.4.0
- https://github.com/advisories/GHSA-xjcv-h5jg-rx3r

Compromised versions (1)

= 0.4.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.