MAL-2026-6748

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/haproxy-config-client/MAL-2026-6748.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6748
Published
2026-07-03T22:43:15Z
Modified
2026-07-08T21:46:53Z
Summary
Malicious code in haproxy-config-client (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6f86ffde45262c5d45a24458a85116ab5ca80451ce3d3159f9d7cad6599ad145)

setup.py registers install, develop, and egg_info command hooks that run a routine which XOR-0x5A-decodes a list of attacker-controlled Cloudflare Workers hostnames (package-proxy.cf5oobworker.workers.dev and four sibling *.workers.dev hosts) and a URL path (/pkg/package), downloads opaque bytes over HTTPS, writes them to /var/tmp/.cache_, chmods 0755, and spawns the binary detached via subprocess.Popen with start_new_session=True. If HTTPS fetch fails, it falls back to a DNS covert channel: raw DNS TXT queries against *.lin.dl.wel1.ru reassemble a base64 payload from serial subdomain lookups, which is then decoded and executed. All C2 hostnames, the URL path, and dynamic-import module names ('base64', 'b64decode', 'b32encode') are XOR-obfuscated byte literals whose only purpose is to hide the destinations from review. The hook is wired into egg_info as well as install/develop, so the payload fires during pip install and even during metadata-only operations. The package itself has no real functionality — src/haproxy_config_client/init.py contains only a version string — and its name plus 'Internal service utilities' summary and 'TBank Engineering' author label are consistent with a dependency-confusion vehicle targeting an internal ops utility.

Source: kam193 (f70d07844bca4fadfcedb195f5768c8a95318af4d62a4bcec94556b99b72c4ad)

During installation the obfuscated code downloads a malicious executable from a remote location. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from c.lin.dl.wel1[.]ru. This record returns a number, which is then used to iterate over domains in the form <0...n>.lin.dl.wel1[.]r and reconstruct the encoded executable from their TXT records. The executable is finally saved under a partially random name, executed, and removed after execution. The Linux executable contacts a few domains, but there is no more detailed information about its behavior available.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-haproxy-config-client

Reasons (based on the campaign):

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • Downloads and executes a remote executable.

  • obfuscation

  • dependency-confusion

  • other

  • malware

  • covering-tracks

  • targetted-attack

  • data-stored-in-dns

Database specific 
{
    "iocs": {
        "domains": [
            "package-proxy.cf5oobworker.workers.dev",
            "package-proxy.cf8oobworker.workers.dev",
            "package-proxy.cf12oobworker.workers.dev",
            "package-proxy.cf17-ddb.workers.dev",
            "package-proxy.cf25-6eb.workers.dev",
            "c.lin.dl.wel1.ru"
        ],
        "urls": [
            "https://package-proxy.cf5oobworker.workers.dev/pkg/package",
            "https://package-proxy.cf8oobworker.workers.dev/pkg/package",
            "https://package-proxy.cf12oobworker.workers.dev/pkg/package",
            "https://package-proxy.cf17-ddb.workers.dev/pkg/package",
            "https://package-proxy.cf25-6eb.workers.dev/pkg/package"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-06-haproxy-config-client/haproxy-config-client",
            "import_time": "2026-07-03T23:26:20.882507498Z",
            "modified_time": "2026-07-03T22:43:15.278764Z",
            "sha256": "f3231df36fad882782125a817ad5881080ef595dc1941b5d77aac3c19e7b2bab",
            "source": "kam193",
            "versions": [
                "8.5.3"
            ]
        },
        {
            "id": "pypi/2026-07-haproxy-config-client/haproxy-config-client",
            "import_time": "2026-07-03T23:51:45.546961499Z",
            "modified_time": "2026-07-03T22:43:15.278764Z",
            "sha256": "f9e96a88174798db94c5c03e458edc05136cbf37abc255590d34c09dcd534688",
            "source": "kam193",
            "versions": [
                "8.5.3"
            ]
        },
        {
            "id": "pypi/2026-07-haproxy-config-client/haproxy-config-client",
            "import_time": "2026-07-05T22:23:38.886834383Z",
            "modified_time": "2026-07-03T22:43:15.278764Z",
            "sha256": "f70d07844bca4fadfcedb195f5768c8a95318af4d62a4bcec94556b99b72c4ad",
            "source": "kam193",
            "versions": [
                "8.5.3"
            ]
        },
        {
            "id": "IN-MAL-2026-008597",
            "import_time": "2026-07-08T21:27:49.348952391Z",
            "modified_time": "2026-07-08T20:34:02Z",
            "sha256": "6f86ffde45262c5d45a24458a85116ab5ca80451ce3d3159f9d7cad6599ad145",
            "source": "amazon-inspector",
            "versions": [
                "8.5.3"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / haproxy-config-client

Package

Name
haproxy-config-client
View open source insights on deps.dev
Purl
pkg:pypi/haproxy-config-client

Affected ranges

Affected versions

8.*
8.5.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "setup.py",
            "sha256": "21553e737ffc63bc67e3fc0724603d77a537ddfa9d0c70bfdbc39c1c04760642",
            "tlsh": "d2c141e2ec4ee1669237cc1e588ad993eb2a810792119413f4fcd744aff5070c6bd68a"
        },
        {
            "path": "PKG-INFO",
            "sha256": "fc75947dd338902746765881c3359d6b15c0c9f4cc805bee3dc74ce82c09c66b",
            "tlsh": "fbc08c24b648c873a2ac435a447d5312a2b94727916b2896c5216a140aa72f8e69e235"
        }
    ],
    "package_integrity": [
        {
            "filename": "haproxy_config_client-8.5.3.tar.gz",
            "hashes": {
                "blake2b_256": "86387f18003d9456fa3235355cf60fe9b59637e21120366579b72f0a8a164ae4",
                "md5": "119afa08616c1a093323992644123a66",
                "sha256": "4af15c290cb1b50c1448fcc60cf38d273d3088afddbd053f1ae7fecef4f48fee"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/haproxy-config-client/MAL-2026-6748.json"