TeamPCP Compromises Telnyx Python Package on PyPI with Malicious Versions
TeamPCP pushed malicious versions 4.87.1 and 4.87.2 of the telnyx package to PyPI on March 27, 2026, hiding a credential stealer in WAV files.
Threat actor TeamPCP, previously behind supply chain attacks on Trivy, KICS, and litellm, has compromised the telnyx Python package by releasing two malicious versions to the Python Package Index. Versions 4.87.1 and 4.87.2 were published on March 27, 2026, and conceal credential harvesting capabilities inside a .WAV file. This marks another supply chain attack aimed at stealing sensitive data from developers who install the affected packages. Source: https://thehackernews.com/2026/03/teampcp-pushes-malicious-telnyx.html
SENTINEL: Regular developers grabbing everyday Python packages could end up handing over their passwords without knowing it, making it tougher for regular folks and AI builders to trust the tools they rely on every day.
Sources (1)
- [1]TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files(https://thehackernews.com/2026/03/teampcp-pushes-malicious-telnyx.html)