TeamPCP Compromises Telnyx Python Package in Supply Chain Attack

On March 27, 2026, TeamPCP, a threat actor known for supply chain attacks, compromised the Telnyx Python package by publishing two malicious versions, 4.87.1 and 4.87.2, to the Python Package Index (PyPI). These versions were designed to steal sensitive data from users' systems, employing a novel method of audio steganography to conceal their malicious payloads within a .WAV file. The PyPI project has since been quarantined, and users are advised to downgrade to version 4.87.0 immediately.

TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV FilesTeamPCP strikes again: Backdoored Telnyx PyPI package delivers malware

The malicious code was injected into the "telnyx/_client.py" file, which is executed when the package is imported into a Python application. The malware targets Windows, Linux, and macOS systems. On Windows, it downloads a file named "hangup.wav" from a command-and-control (C2) server, extracting an executable that persists in the Startup folder. Conversely, on Linux and macOS, it retrieves a different .WAV file ("ringtone.wav") to execute a data harvester, which operates in a temporary directory and leaves minimal forensic traces.

TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV FilesTeamPCP strikes again: Backdoored Telnyx PyPI package delivers malware

This incident follows a series of attacks by TeamPCP, including the compromise of the LiteLLM Python package, which aimed to exfiltrate cloud credentials and CI/CD secrets. The attack on Telnyx reflects a strategic evolution in TeamPCP's tactics, focusing on infecting legitimate packages with extensive user bases rather than relying solely on malicious typosquats. The group has also collaborated with other cybercriminal organizations, such as LAPSUS$ and Vect, to enhance their operational capabilities.

TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files

The malware is engineered to capture a wide array of sensitive information, including SSH keys, cloud credentials, and API tokens. The exfiltration occurs via an HTTP POST request to a specified IP address, with the stolen data encrypted in a file named "tpcp.tar.gz." The attack's design allows for rapid data collection and immediate exfiltration, particularly on Linux and macOS systems, which lack a persistence mechanism.

TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files

The maintainers of the Telnyx package confirmed the removal of the malicious versions from PyPI and are investigating how the publishing credentials were compromised. They suspect that the credentials were obtained through prior attacks on the LiteLLM package. Security experts have advised developers to audit their environments for the compromised versions and rotate all secrets.

TeamPCP strikes again: Backdoored Telnyx PyPI package delivers malware

Experts have raised concerns about the implications of such supply chain attacks, emphasizing the need for enhanced security measures in CI/CD environments. Socket, a security researcher, highlighted that the attack underscores vulnerabilities in tools that require broad access, suggesting that anything running in the pipeline should be treated as a potential entry point for attackers.

TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files

As investigations continue, developers are urged to implement stringent security practices, including monitoring for indicators of compromise associated with TeamPCP. The ongoing threat landscape necessitates vigilance, particularly as ransomware groups increasingly leverage supply chain vulnerabilities to facilitate follow-on attacks.

TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files

“Rather than hosting a raw executable or a base64 blob on the C2 (both of which are trivially flagged by network inspection and EDR), the attacker wraps the payload inside a .WAV file.” — Moshe Siman Tov Bustan, OX Security

TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files

“Treat any match as a full-environment compromise — rotate all credentials,” — Endor Labs Researchers

TeamPCP strikes again: Backdoored Telnyx PyPI package delivers malware

“This puts a spotlight on anything in CI/CD environments that isn’t locked down," Socket said.” — Socket, Security Researcher

TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files

“TeamPCP's harvester swept environment variables, .env files, and shell histories from every system that imported litellm. If any developer or CI pipeline had both litellm installed and access to the telnyx PyPI token, that token was already in TeamPCP's hands.” — Kiran Raj, Endor Labs

TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files