Loading story…
The Telnyx Python SDK distributed on PyPI was quarantined after researchers found it had been compromised with malicious code that executed at import time, allowing the payload to run as soon as a developer loaded the package rather than calling a specific function. The malicious logic was reportedly hidden inside a .wav media file, using insecure deserialization of a trusted-looking audio asset to evade detection inside a widely used client library.
The incident raised supply-chain concerns because the package had roughly 742,000 downloads in the previous month, giving the compromise a potentially large blast radius across developer and production environments. Semgrep linked the activity to TeamPCP and said the Telnyx package was the second notable Python package victim attributed to that actor in the same week, underscoring how trusted client SDKs can become a blind spot in dependency security review.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
In its March 27, 2026 blog post, Semgrep attributed the Telnyx Python SDK supply-chain compromise to TeamPCP. The article also said this was the second notable Python package victim tied to that actor in the same week.
Semgrep reports that the Telnyx Python SDK on PyPI was found to contain malicious behavior and was subsequently quarantined. The malicious code executed at import time and hid its payload inside a .wav file, creating a significant potential impact due to the package's large download volume.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The `telnyx` Python SDK on PyPI was compromised after malicious versions `4.87.1` and `4.87.2` were published with code injected into `telnyx/_client.py`, causing malware to run automatically when the package was imported. Researchers linked the activity to **TeamPCP**, tying it to the same supply-chain campaign that previously hit projects including Trivy, LiteLLM, npm packages, and Checkmarx assets. The tainted releases fetched second-stage payloads hidden in WAV files such as `hangup.wav` and `ringtone.wav` from `83.142.209.203:8080`, using steganography to conceal the malware.
Aug 21, 2026
Security reporting from Palo Alto Networks, GitHub, and Cisco Talos shows software supply-chain abuse continuing to intensify, with open-source ecosystems facing rising volumes of vulnerabilities, advisories, and malware. Incident responders said attackers increasingly target developers and build environments because they provide access to source code, CI/CD pipelines, cloud infrastructure, and enterprise endpoints, turning package repositories into an efficient initial-access vector. Cisco Talos detailed how malicious Python packages can execute payloads during installation as well as at runtime by abusing build hooks and package contents, including `setup.py` command classes, `.pth` files, `sitecustomize` and `usercustomize` hooks, `PYTHONPATH` manipulation, import-time code in `__init__.py`, `__main__.py`, and hijacked entry points. The research cited real-world supply-chain cases including TeamPCP activity, the `litellm` compromise, VIPERTUNNEL abuse of site hooks, and the lightning compromise, while defenders were urged to harden package intake with lock files, cryptographic hashes, isolated build environments, SBOM generation, dependency cooldowns, package auditing, and PyPI Trusted Publishing via OIDC.
Jul 14, 2026
Datadog Security Labs reported that the **TeamPCP** supply-chain campaign compromised the legitimate PyPI package **LiteLLM**, publishing malicious versions `1.82.7` and `1.82.8` that stole credentials, exfiltrated data, established persistence, and in some cases attempted to spread into Kubernetes environments. The campaign also hit **Telnyx** on PyPI and was linked to earlier compromises involving Trivy, npm packages, Aqua Security repositories, and Checkmarx tooling, with researchers concluding that stolen CI/CD and publishing credentials were reused across ecosystems. Datadog warned that LiteLLM `1.82.8` was especially dangerous because a malicious `.pth` file triggered payload execution when the Python interpreter started, while the Telnyx package executed code at import time and retrieved a second-stage payload hidden in a WAV file. Separately, X41 disclosed a high-severity **sandbox escape** in BerriAI LiteLLM affecting the `main-latest` Docker image, where authenticated users could reach arbitrary code execution through the `/guardrails/test_custom_code` API endpoint. The flaw relied on bypassing regex-based restrictions on custom Python guardrail code using string concatenation and CPython bytecode rewriting to recover unrestricted builtins and call `__import__`, allowing commands to run as the LiteLLM process user, which is **root** in the default Docker deployment. X41 assigned the issue **CWE-94** and a **CVSS 4.0 score of 8.7**, and Datadog advised organizations that installed the malicious LiteLLM releases to treat affected hosts and CI jobs as full credential-exposure events, rotate secrets, hunt for persistence and outbound traffic, and rebuild critical systems from known-good images rather than relying only on package rollback.
Jun 30, 2026