MAL-2026-6749

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ipa-user-collector/MAL-2026-6749.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6749
Published
2026-07-03T22:45:17Z
Modified
2026-07-04T00:00:56.244246762Z
Summary
Malicious code in ipa-user-collector (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (f6740d6a9e24bf6219b8f1c07ef005df676552e1b9656d5e0b1c7b6cfc6f3086)

During installation the obfuscated code downloads a malicious executable from a remote location. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from c.lin.dl.wel1[.]ru. This record returns a number, which is then used to iterate over domains in the form <0...n>.lin.dl.wel1[.]r and reconstruct the encoded executable from their TXT records. The executable is finally saved under a partially random name, executed, and removed after execution. The Linux executable contacts a few domains, but there is no more detailed information about its behavior available.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-haproxy-config-client

Reasons (based on the campaign):

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • Downloads and executes a remote executable.

  • obfuscation

  • dependency-confusion

  • other

  • malware

  • covering-tracks

  • targetted-attack

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "8.5.3"
            ],
            "sha256": "f6740d6a9e24bf6219b8f1c07ef005df676552e1b9656d5e0b1c7b6cfc6f3086",
            "source": "kam193",
            "modified_time": "2026-07-03T22:45:17.899969Z",
            "import_time": "2026-07-03T23:26:20.883497465Z",
            "id": "pypi/2026-06-haproxy-config-client/ipa-user-collector"
        },
        {
            "versions": [
                "8.5.3"
            ],
            "sha256": "9fec164dfe33b84c2cdf2554ecd2dc75c8cd2f0056bccea3f91908aa745f1136",
            "source": "kam193",
            "modified_time": "2026-07-03T22:45:17.899969Z",
            "import_time": "2026-07-03T23:51:45.553563554Z",
            "id": "pypi/2026-07-haproxy-config-client/ipa-user-collector"
        }
    ],
    "iocs": {
        "urls": [
            "https://package-proxy.cf5oobworker.workers.dev/pkg/package",
            "https://package-proxy.cf8oobworker.workers.dev/pkg/package",
            "https://package-proxy.cf12oobworker.workers.dev/pkg/package",
            "https://package-proxy.cf17-ddb.workers.dev/pkg/package",
            "https://package-proxy.cf25-6eb.workers.dev/pkg/package"
        ],
        "domains": [
            "package-proxy.cf5oobworker.workers.dev",
            "package-proxy.cf8oobworker.workers.dev",
            "package-proxy.cf12oobworker.workers.dev",
            "package-proxy.cf17-ddb.workers.dev",
            "package-proxy.cf25-6eb.workers.dev",
            "c.lin.dl.wel1.ru"
        ]
    }
}
References
Credits

Affected packages

PyPI / ipa-user-collector

Package

Name
ipa-user-collector
View open source insights on deps.dev
Purl
pkg:pypi/ipa-user-collector

Affected ranges

Affected versions

8.*
8.5.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ipa-user-collector/MAL-2026-6749.json"