Telnyx PyPI Package Compromised: Another Supply Chain Attack You Didn't See Coming
On March 27, 2026, someone ran pip install telnyx and their credentials were silently exfiltrated to an attacker-controlled server. No error. No warning. Just a routine package install that shipped malware straight into production.
The telnyx Python SDK— 742,000 downloads in the last month - was compromised by a threat actor called TeamPCP. Two malicious versions (4.87.1 and 4.87.2) were pushed to PyPI. The moment any application ran import telnyx, the malware executed.
This wasn't an isolated incident. It was the fifth major attack in nine days by the same group. And if you're building software that depends on open source packages — which is everyone — this should keep you up at night.
What Happened to Telnyx
Telnyx is a cloud communications platform. Their Python SDK is used across telephony applications, call automation, and messaging infrastructure. The kind of software that runs in production, often with access to sensitive credentials.
The attacker modified a single file — telnyx/_client.py — and injected 74 lines of malicious code. Here's what it did:
On Linux and macOS:
- Downloaded a
.wav audio file from the attacker's server
- Extracted a hidden Python script from inside the audio data using steganography
- Harvested SSH keys, cloud credentials, environment variables, and shell history
- Encrypted everything with AES-256 and RSA-4096
- Exfiltrated the bundle to the attacker's C2 server
On Windows:
- Downloaded a different
.wav file
- Decoded a Windows executable hidden inside it
- Dropped it as
msbuild.exe in the Windows Startup folder
- The binary runs silently on every login — persistent access
The .wav trick is worth noting. The payload wasn't a script or a binary. It was disguised as a valid audio file. Content filters that allow .wav downloads wouldn't flag it. The malicious data was hiding in the audio frames, decoded at runtime using XOR. As Aikido's Charlie Eriksen noted, TeamPCP first used this WAV steganography technique on March 22 and liked it enough to keep deploying it.
Five Attacks in Nine Days: The TeamPCP Campaign
Telnyx wasn't the beginning. It was the latest domino. Here's the full timeline, as documented by Aikido and StepSecurity:
1. Trivy — March 19
Aqua Security's open source vulnerability scanner was backdoored (CVE-2026-33634, CVSS 9.4). Every CI/CD pipeline running Trivy without version pinning had credentials exfiltrated. The attacker renamed 44 Aqua Security GitHub repositories with the prefix tpcp-docs-. This gave TeamPCP the stolen credentials they needed for everything that followed.
2. CanisterWorm on npm — March 20
Using tokens stolen from Trivy users, TeamPCP published a self-replicating backdoor — CanisterWorm — across 46+ npm packages including scopes like @EmilGroup and @opengov. Given one stolen npm token, the worm enumerated all publishable packages, bumped versions, and published compromised code across the entire scope in under 60 seconds.
3. Checkmarx GitHub Actions — March 23
The kics-github-action and ast-github-action GitHub Actions were compromised, along with two OpenVSX extensions. 35 tags were hijacked in under four hours. The payload used a new C2 domain impersonating the Checkmarx brand.
4. LiteLLM on PyPI — March 24
LiteLLM — roughly 95 million downloads per month, widely deployed as a centralized LLM gateway with access to credentials for OpenAI, Anthropic, AWS Bedrock, and GCP VertexAI — had versions 1.82.7 and 1.82.8 compromised. The credentials were stolen from LiteLLM's CI/CD pipeline, which ran unpinned Trivy. PyPI quarantined the packages after about three hours.
5. Telnyx on PyPI — March 27
The compromise described above. Same RSA-4096 public key. Same tpcp.tar.gz exfiltration signature. Same encryption scheme. Different package, same playbook.
The pattern: Compromise a trusted tool → steal credentials from its users → use those credentials to compromise the next target → repeat.
Why Supply Chain Attacks Keep Working
This isn't new. And that's the problem.
- 2024: The
xz-utils backdoor nearly compromised every Linux system on the planet through a years-long social engineering campaign on a single maintainer.
- 2025: Multiple PyPI typosquatting campaigns targeted popular packages like
requests, boto3, and tensorflow.
- 2026: TeamPCP is running a multi-week, multi-ecosystem campaign — PyPI, npm, GitHub Actions, VS Code extensions — and they're iterating in real time.
The reason this keeps working comes down to a few uncomfortable truths:
1. Most teams don't pin dependencies.
Running pip install --upgrade telnyx on March 27 silently pulled malware. No flag. No diff. Just the latest version, because that's what "latest" meant that morning.
2. Supply chain isn't in the threat model.
Application security focuses on your code. Infrastructure security focuses on your servers. But the code that runs in your environment is overwhelmingly code you didn't write. Most security programs treat package registries as trusted sources.
3. Detection is hard.
TeamPCP used WAV steganography, base64 encoding, XOR obfuscation, and detached subprocesses. The malware runs at import time, cleans up after itself, and leaves no artifacts on disk. Traditional security scanners don't catch this.
4. The blast radius is massive.
One compromised package with 742K monthly downloads means thousands of environments potentially exfiltrated before anyone notices. LiteLLM's 95 million monthly downloads makes it even worse.
What You Should Do Right Now
If you installed telnyx==4.87.1 or telnyx==4.87.2:
# Check your version
pip show telnyx
# Downgrade immediately
pip install "telnyx==4.87.0"
Then rotate everything: SSH keys, API keys, cloud credentials, environment variables, database passwords — anything accessible on that machine. Check for outbound connections to 83.142.209.203 on port 8080 in your network logs.
On Windows, check for msbuild.exe in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ and delete it.
For everyone else — the structural fixes:
Pin your dependencies. Use lock files (pip freeze, poetry.lock, package-lock.json). Don't let pip install --upgrade surprise you.
Enable hash verification. pip install --require-hashes ensures you only install the exact artifact you expect.
Audit your CI/CD supply chain. If your pipeline installs packages, runs GitHub Actions, or pulls container images — those are all attack surfaces. Pin actions to commit SHAs, not version tags.
Monitor for anomalous network connections. Outbound HTTP to unexpected IPs from your build or application servers is a red flag.
Use dependency scanning tools. Services like Aikido, StepSecurity, Socket.dev, and Snyk can detect compromised packages — sometimes within hours.
Assume your dependencies will be compromised. Build your security posture around that assumption. Least-privilege access, network segmentation, credential rotation, and runtime monitoring aren't optional anymore.
The Bigger Picture
TeamPCP compromised five packages across three ecosystems in nine days. They're using novel techniques (WAV steganography), iterating rapidly (fixing bugs between 4.87.1 and 4.87.2), and chaining credentials across tools. This isn't a script kiddie. This is an operationally mature threat actor running an organized campaign.
The open source ecosystem is infrastructure. It powers everything from startups to banks to hospitals. And right now, the security model is fundamentally broken: a single compromised maintainer account or CI/CD token can push malware to millions of machines before anyone blinks.
Until package registries, build systems, and organizations treat supply chain security as a first-class concern — not an afterthought — we'll keep writing these posts. And another package will bite the dust.
References
Virendra Singh Bhalothia
