holiday-of-12306

No clear indicators of intentional malware (no credential theft, exfiltration, or backdoor behavior) were found in this module. However, the code can download and install an upgraded `chinesecalendar` package at runtime via `pip install --upgrade` and then reload/import it immediately, creating a significant supply-chain execution risk if the upstream package or package index is compromised or if untrusted dependency sources are used. Recommendation: disable runtime auto-upgrades in production, pin to known-good versions, and enforce trusted indexes plus integrity/signature verification.