haproxy-config-clientPyPI
Malicious code in haproxy-config-client (PyPI) Remove it immediately and rotate any exposed credentials.
What this malware does
setup.py registers install, develop, and egg_info command hooks that run a routine which XOR-0x5A-decodes a list of attacker-controlled Cloudflare Workers hostnames (package-proxy.cf5oobworker.workers.dev and four sibling *.workers.dev hosts) and a URL path (/pkg/package), downloads opaque bytes over HTTPS, writes them to /var/tmp/.cache_<random>, chmods 0755, and spawns the binary detached via subprocess.Popen with start_new_session=True. If HTTPS fetch fails, it falls back to a DNS covert channel: raw DNS TXT queries against *.lin.dl.wel1.ru reassemble a base64 payload from serial subdomain lookups, which is then decoded and executed. All C2 hostnames, the URL path, and dynamic-import module names ('base64', 'b64decode', 'b32encode') are XOR-obfuscated byte literals whose only purpose is to hide the destinations from review. The hook is wired into egg_info as well as install/develop, so the payload fires during pip install and even during metadata-only operations. The package itself has no real functionality — src/haproxy_config_client/init.py contains only a version string — and its name plus 'Internal service utilities' summary and 'TBank Engineering' author label are consistent with a dependency-confusion vehicle targeting an internal ops utility.
During installation the obfuscated code downloads a malicious executable from a remote location. Code is designed to survive different blocks: first, there is an attempt to download the executable from one of five Cloudflare Workers. If it's not successful, the code falls back to download using DNS: first, it gets a TXT record from c.lin.dl.wel1[.]ru. This record returns a number, which is then used to iterate over domains in the form <0...n>.lin.dl.wel1[.]r and reconstruct the encoded executable from their TXT records. The executable is finally saved under a partially random name, executed, and removed after execution. The Linux executable contacts a few domains, but there is no more detailed information about its behavior available.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-07-haproxy-config-client
Reasons (based on the campaign):
-
The package overrides the install command in setup.py to execute malicious code during installation.
-
Downloads and executes a remote executable.
-
obfuscation
-
dependency-confusion
-
other
-
malware
-
covering-tracks
-
targetted-attack
-
data-stored-in-dns
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for haproxy-config-client (version 8.5.3). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging haproxy-config-client across your stack and pipelines.
If you installed it — respond
haproxy-config-client is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If haproxy-config-client was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks haproxy-config-client before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- Kamil Mańkowski (kam193) · reporter
Detect & block this
O3 blocks haproxy-config-client-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.