{"id":"MAL-2026-6748","summary":"Malicious code in haproxy-config-client (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6f86ffde45262c5d45a24458a85116ab5ca80451ce3d3159f9d7cad6599ad145)\nsetup.py registers install, develop, and egg_info command hooks that run a routine which XOR-0x5A-decodes a list of attacker-controlled Cloudflare Workers hostnames (package-proxy.cf5oobworker.workers.dev and four sibling *.workers.dev hosts) and a URL path (/pkg/package), downloads opaque bytes over HTTPS, writes them to /var/tmp/.cache_\u003crandom\u003e, chmods 0755, and spawns the binary detached via subprocess.Popen with start_new_session=True. If HTTPS fetch fails, it falls back to a DNS covert channel: raw DNS TXT queries against `*.lin.dl.wel1.ru` reassemble a base64 payload from serial subdomain lookups, which is then decoded and executed. All C2 hostnames, the URL path, and dynamic-import module names ('base64', 'b64decode', 'b32encode') are XOR-obfuscated byte literals whose only purpose is to hide the destinations from review. The hook is wired into egg_info as well as install/develop, so the payload fires during `pip install` and even during metadata-only operations. The package itself has no real functionality — src/haproxy_config_client/__init__.py contains only a __version__ string — and its name plus 'Internal service utilities' summary and 'TBank Engineering' author label are consistent with a dependency-confusion vehicle targeting an internal ops utility.\n\n## Source: kam193 (f70d07844bca4fadfcedb195f5768c8a95318af4d62a4bcec94556b99b72c4ad)\nDuring installation the obfuscated code downloads a malicious executable from a remote location. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from c.lin.dl.wel1[.]ru. This record returns a number, which is then used to iterate over domains in the form \u003c0...n\u003e.lin.dl.wel1[.]r and reconstruct the encoded executable from their TXT records. The executable is finally saved under a partially random name, executed, and removed after execution. The Linux executable contacts a few domains, but there is no more detailed information about its behavior available.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-07-haproxy-config-client\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - dependency-confusion\n\n\n - other\n\n\n - malware\n\n\n - covering-tracks\n\n\n - targetted-attack\n\n\n - data-stored-in-dns\n","modified":"2026-07-08T21:46:53.137024704Z","published":"2026-07-03T22:43:15Z","database_specific":{"iocs":{"domains":["package-proxy.cf5oobworker.workers.dev","package-proxy.cf8oobworker.workers.dev","package-proxy.cf12oobworker.workers.dev","package-proxy.cf17-ddb.workers.dev","package-proxy.cf25-6eb.workers.dev","c.lin.dl.wel1.ru"],"urls":["https://package-proxy.cf5oobworker.workers.dev/pkg/package","https://package-proxy.cf8oobworker.workers.dev/pkg/package","https://package-proxy.cf12oobworker.workers.dev/pkg/package","https://package-proxy.cf17-ddb.workers.dev/pkg/package","https://package-proxy.cf25-6eb.workers.dev/pkg/package"]},"malicious-packages-origins":[{"versions":["8.5.3"],"source":"kam193","sha256":"f3231df36fad882782125a817ad5881080ef595dc1941b5d77aac3c19e7b2bab","import_time":"2026-07-03T23:26:20.882507498Z","id":"pypi/2026-06-haproxy-config-client/haproxy-config-client","modified_time":"2026-07-03T22:43:15.278764Z"},{"sha256":"f9e96a88174798db94c5c03e458edc05136cbf37abc255590d34c09dcd534688","import_time":"2026-07-03T23:51:45.546961499Z","id":"pypi/2026-07-haproxy-config-client/haproxy-config-client","modified_time":"2026-07-03T22:43:15.278764Z","versions":["8.5.3"],"source":"kam193"},{"import_time":"2026-07-05T22:23:38.886834383Z","id":"pypi/2026-07-haproxy-config-client/haproxy-config-client","modified_time":"2026-07-03T22:43:15.278764Z","versions":["8.5.3"],"source":"kam193","sha256":"f70d07844bca4fadfcedb195f5768c8a95318af4d62a4bcec94556b99b72c4ad"},{"versions":["8.5.3"],"source":"amazon-inspector","sha256":"6f86ffde45262c5d45a24458a85116ab5ca80451ce3d3159f9d7cad6599ad145","import_time":"2026-07-08T21:27:49.348952391Z","id":"IN-MAL-2026-008597","modified_time":"2026-07-08T20:34:02Z"}]},"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/d47a2d1b96df84b10263a99866b865421b334448432d1b447b82c76253bcbe86/detection"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/haproxy-config-client"},{"type":"PACKAGE","url":"https://pypi.org/project/haproxy-config-client/8.5.3/"}],"affected":[{"package":{"name":"haproxy-config-client","ecosystem":"PyPI","purl":"pkg:pypi/haproxy-config-client"},"versions":["8.5.3"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"d2c141e2ec4ee1669237cc1e588ad993eb2a810792119413f4fcd744aff5070c6bd68a","path":"setup.py","sha256":"21553e737ffc63bc67e3fc0724603d77a537ddfa9d0c70bfdbc39c1c04760642"},{"sha256":"fc75947dd338902746765881c3359d6b15c0c9f4cc805bee3dc74ce82c09c66b","tlsh":"fbc08c24b648c873a2ac435a447d5312a2b94727916b2896c5216a140aa72f8e69e235","path":"PKG-INFO"}],"package_integrity":[{"filename":"haproxy_config_client-8.5.3.tar.gz","hashes":{"md5":"119afa08616c1a093323992644123a66","sha256":"4af15c290cb1b50c1448fcc60cf38d273d3088afddbd053f1ae7fecef4f48fee","blake2b_256":"86387f18003d9456fa3235355cf60fe9b59637e21120366579b72f0a8a164ae4"}}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/haproxy-config-client/MAL-2026-6748.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}