The haproxy-config-client PyPI package version 8.5.3 contains obfuscated malicious code embedded in its setup.py that overrides the install command to execute during package installation. This code attempts to download a Linux executable payload from one of five Cloudflare Workers. If unsuccessful, it uses DNS TXT records from a specified domain to reconstruct the executable in parts. The payload is saved under a partially randomized filename, executed, and then removed to cover tracks. The executable contacts multiple domains, though no further behavioral details are provided. This campaign is identified as malicious, involving dependency confusion and targeted attack techniques.

Installation of haproxy-config-client version 8.5.3 results in execution of a remote malicious payload on the host system. This can lead to compromise of the affected Linux system, including potential data theft, unauthorized access, or further malware deployment. The malicious code uses obfuscation and multiple fallback mechanisms to evade detection and ensure execution. The exact post-execution impact is not detailed, but the behavior is consistent with malware infection and targeted attacks.

No official patch or remediation is currently available for haproxy-config-client version 8.5.3. Users should avoid installing this specific version of the package. Verify package integrity and source before installation. Monitor for updates from the package maintainer or PyPI security teams for any official fixes or removals. Consider using trusted package sources and supply chain security tools to detect malicious packages.