MAL-2026-6748

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/haproxy-config-client/MAL-2026-6748.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6748
Published
2026-07-03T22:43:15Z
Modified
2026-07-04T00:00:56.150164562Z
Summary
Malicious code in haproxy-config-client (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (f3231df36fad882782125a817ad5881080ef595dc1941b5d77aac3c19e7b2bab)

During installation the obfuscated code downloads a malicious executable from a remote location. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from c.lin.dl.wel1[.]ru. This record returns a number, which is then used to iterate over domains in the form <0...n>.lin.dl.wel1[.]r and reconstruct the encoded executable from their TXT records. The executable is finally saved under a partially random name, executed, and removed after execution. The Linux executable contacts a few domains, but there is no more detailed information about its behavior available.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-haproxy-config-client

Reasons (based on the campaign):

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • Downloads and executes a remote executable.

  • obfuscation

  • dependency-confusion

  • other

  • malware

  • covering-tracks

  • targetted-attack

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "8.5.3"
            ],
            "sha256": "f3231df36fad882782125a817ad5881080ef595dc1941b5d77aac3c19e7b2bab",
            "modified_time": "2026-07-03T22:43:15.278764Z",
            "source": "kam193",
            "import_time": "2026-07-03T23:26:20.882507498Z",
            "id": "pypi/2026-06-haproxy-config-client/haproxy-config-client"
        },
        {
            "versions": [
                "8.5.3"
            ],
            "sha256": "f9e96a88174798db94c5c03e458edc05136cbf37abc255590d34c09dcd534688",
            "source": "kam193",
            "modified_time": "2026-07-03T22:43:15.278764Z",
            "import_time": "2026-07-03T23:51:45.546961499Z",
            "id": "pypi/2026-07-haproxy-config-client/haproxy-config-client"
        }
    ],
    "iocs": {
        "urls": [
            "https://package-proxy.cf5oobworker.workers.dev/pkg/package",
            "https://package-proxy.cf8oobworker.workers.dev/pkg/package",
            "https://package-proxy.cf12oobworker.workers.dev/pkg/package",
            "https://package-proxy.cf17-ddb.workers.dev/pkg/package",
            "https://package-proxy.cf25-6eb.workers.dev/pkg/package"
        ],
        "domains": [
            "package-proxy.cf5oobworker.workers.dev",
            "package-proxy.cf8oobworker.workers.dev",
            "package-proxy.cf12oobworker.workers.dev",
            "package-proxy.cf17-ddb.workers.dev",
            "package-proxy.cf25-6eb.workers.dev",
            "c.lin.dl.wel1.ru"
        ]
    }
}
References
Credits

Affected packages

PyPI / haproxy-config-client

Package

Name
haproxy-config-client
View open source insights on deps.dev
Purl
pkg:pypi/haproxy-config-client

Affected ranges

Affected versions

8.*
8.5.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/haproxy-config-client/MAL-2026-6748.json"