← Supply-Chain Attack Compendium

telnyx

Incident Summary

Telnyx PyPI WAV Steganography Credential Stealer

TeamPCP compromised Telnyx Python SDK releases 4.87.1 and 4.87.2 by adding import-time malware to the PyPI artifacts. The payload hid a second-stage credential stealer inside WAV audio data, collected developer, cloud, package-manager, and wallet secrets, encrypted them with the same TeamPCP RSA/AES scheme seen in LiteLLM, and exfiltrated them as tpcp.tar.gz. Version 4.87.2 also repaired a Windows branch intended to decode and persist a PE backdoor. The case stands out for using audio steganography inside a legitimate communications SDK package.

Date
2026-03-27
Category
Open Source
Target Surface
Package registry
Insertion Phase
distribution
Impact
Credential theft
Cause
Compromised Account/Credentials

What Was Affected

Package telnyx
LanguagePython
ComponentLibrary
Artifact typesource archive
Domain typepackage host
Domain pypi.org

Compromised Versions

Incident Context

Motive
Credential Theft
Attribution
Advanced Persistent Threat
Transitive
Yes
User Impact
742000
Observed Duration
0 days

Evidence

Compromised Artifacts

Indicators and Changes

Hashes

  • sha256:f66c1ea3b25ec95d0c6a07be92c761551e543a7b256f9c78a2ff781c77df7093
  • sha256:a9235c0eb74a8e92e5a0150e055ee9dcdc6252a07785b6677a9ca831157833a5

External References

Source Data

Source record: oss/telnyx/meta.yaml