{"id":"MAL-2026-6749","summary":"Malicious code in ipa-user-collector (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (f6740d6a9e24bf6219b8f1c07ef005df676552e1b9656d5e0b1c7b6cfc6f3086)\nDuring installation the obfuscated code downloads a malicious executable from a remote location. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from c.lin.dl.wel1[.]ru. This record returns a number, which is then used to iterate over domains in the form \u003c0...n\u003e.lin.dl.wel1[.]r and reconstruct the encoded executable from their TXT records. The executable is finally saved under a partially random name, executed, and removed after execution. The Linux executable contacts a few domains, but there is no more detailed information about its behavior available.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-haproxy-config-client\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - dependency-confusion\n\n\n - other\n\n\n - malware\n\n\n - covering-tracks\n\n\n - targetted-attack\n","modified":"2026-07-04T00:00:56.244246762Z","published":"2026-07-03T22:45:17Z","database_specific":{"iocs":{"domains":["package-proxy.cf5oobworker.workers.dev","package-proxy.cf8oobworker.workers.dev","package-proxy.cf12oobworker.workers.dev","package-proxy.cf17-ddb.workers.dev","package-proxy.cf25-6eb.workers.dev","c.lin.dl.wel1.ru"],"urls":["https://package-proxy.cf5oobworker.workers.dev/pkg/package","https://package-proxy.cf8oobworker.workers.dev/pkg/package","https://package-proxy.cf12oobworker.workers.dev/pkg/package","https://package-proxy.cf17-ddb.workers.dev/pkg/package","https://package-proxy.cf25-6eb.workers.dev/pkg/package"]},"malicious-packages-origins":[{"sha256":"f6740d6a9e24bf6219b8f1c07ef005df676552e1b9656d5e0b1c7b6cfc6f3086","versions":["8.5.3"],"import_time":"2026-07-03T23:26:20.883497465Z","id":"pypi/2026-06-haproxy-config-client/ipa-user-collector","modified_time":"2026-07-03T22:45:17.899969Z","source":"kam193"},{"sha256":"9fec164dfe33b84c2cdf2554ecd2dc75c8cd2f0056bccea3f91908aa745f1136","versions":["8.5.3"],"import_time":"2026-07-03T23:51:45.553563554Z","id":"pypi/2026-07-haproxy-config-client/ipa-user-collector","modified_time":"2026-07-03T22:45:17.899969Z","source":"kam193"}]},"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/d47a2d1b96df84b10263a99866b865421b334448432d1b447b82c76253bcbe86/detection"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/ipa-user-collector"}],"affected":[{"package":{"name":"ipa-user-collector","ecosystem":"PyPI","purl":"pkg:pypi/ipa-user-collector"},"versions":["8.5.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ipa-user-collector/MAL-2026-6749.json"}}],"schema_version":"1.7.5","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}