MAL-2026-6748
Malicious code in haproxy-config-client (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: kam193 (f3231df36fad882782125a817ad5881080ef595dc1941b5d77aac3c19e7b2bab) During installation the obfuscated code downloads a malicious executable from a remote location. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from c.lin.dl.wel1[.]ru. This record returns a number, which is then used to iterate over domains in the form <0...n>.lin.dl.wel1[.]r and reconstruct the encoded executable from their TXT records. The executable is finally saved under a partially random name, executed, and removed after execution. The Linux executable contacts a few domains, but there is no more detailed information about its behavior available.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-haproxy-config-client
Reasons (based on the campaign):
- The package overrides the install command in setup.py to execute malicious code during installation.
- Downloads and executes a remote executable.
- obfuscation
- dependency-confusion
- other
- malware
- covering-tracks
- targetted-attack
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for haproxy-config-client (pip). Pin to a known-safe version or switch to an alternative.