If you use the Telnyx Python SDK and you installed it today, stop what you’re doing. Two versions pushed to PyPI in the early hours of March 27 – 4.87.1 and 4.87.2 are malicious. The malware runs the moment you type import telnyx . No setup hooks, no prompts, no warning. It just runs. Downgrade to telnyx==4.87.0 immediately, then keep reading. What Happened At 03:51 UTC this morning, someone pushed two poisoned versions of the Telnyx SDK to PyPI. The package gets about 742,000 downloads a month – contact centers, voice platforms, comms-heavy SaaS. These aren’t hobbyist installs. The group behind it is TeamPCP. They’ve been running the same playbook for three weeks: compromise a trusted security tool, drain its credentials, use those credentials to push malware into whatever that tool had access to, collect new credentials from the next wave of victims, repeat. The Telnyx attack is their fifth public move in nine days. Telnyx Logo What’s different this time and worth paying attention to is how the payload gets delivered. TeamPCP doesn’t fetch a raw binary or a Python script. They fetch a .wav file. A structurally valid audio file. The malware is hidden inside the audio frame data using XOR obfuscation. It passes MIME-type checks. It’ll slip through URL filters that allow .wav downloads. You won’t catch it with standard static analysis unless you know specifically to decode the WAV frames. They first used this technique five days ago in a Kubernetes wiper. It went from experiment to production PyPI attack in less than a week. Who Did This, and Why Does It Keep Happening? The group behind this is TeamPCP . This is their fifth public attack in nine days, and it’s not random targeting. They’ve been running a deliberate credential harvesting chain since March 19, they started compromising one tool, steal its secrets, use those secrets to push malware into whatever that tool had access to, collect new credentials from the next wave of victims, and repeat. March 19 – Trivy (CVE-2026-33634, CVSS 9.4) Aqua Security’s open source vulnerability scanner got backdoored. Every CI/CD pipeline running Trivy without version pinning had its secrets exfiltrated. API tokens, cloud credentials, package registry keys – all of it. TeamPCP also renamed 44 Aqua Security GitHub repos with the prefix tpcp-docs- and changed their descriptions to “TeamPCP Owns Aqua Security.” Subtle. March 20 – CanisterWorm across npm Using stolen npm tokens from Trivy victims, TeamPCP deployed CanisterWorm: a worm that takes a single stolen token, enumerates every package that token can publish, bumps the version, and injects malicious code across the entire scope. Sixty seconds. Forty-six-plus packages compromised, including @EmilGroup and @opengov . March 22 – WAV steganography appears Researchers spotted TeamPCP using the WAV frame trick for the first time in a Kubernetes wiper variant. It looked like an experiment. It wasn’t. March 23 – Checkmarx kics-github-action and ast-github-action were compromised, along with two OpenVSX extensions. The C2 domain was checkmarx[.]zone deliberately chosen to look like the real company. Thirty-five git tags hijacked in under four hours. Cleaned up three hours later. March 24 – LiteLLM LiteLLM is a proxy that sits in front of your OpenAI, Anthropic, AWS Bedrock, and GCP VertexAI keys. Basically a master keyring for an organization’s entire AI stack. Versions 1.82.7 and 1.82.8 were published using credentials from LiteLLM’s own CI/CD pipeline, which was running unpinned Trivy. PyPI quarantined them after about three hours. Roughly 95 million downloads a month the window was brief, the exposure wasn’t. March 27 – Telnyx Two malicious versions pushed overnight, no corresponding GitHub tags or releases. They didn’t come from Telnyx’s own build process. How They Got In The Telnyx GitHub repository shows no signs of compromise at all. Every recent push was from stainless-app[bot] , the automated SDK generation platform that manages the pipeline. No force pushes, no unknown contributors, no sketchy PRs. The last legitimate PyPI publish was v4.87.0 on March 26, through the proper publish-pypi.yml GitHub Actions workflow. No workflow run exists for 4.87.1 or 4.87.2. The attacker uploaded the malicious wheels directly to PyPI – manually, from their own machine. How do we know? The upload tool fingerprint gives it away. The legitimate Telnyx CI pipeline uses rye publish . The PyPI metadata for 4.87.2 shows the upload client as twine/6.2.0 CPython/3.14.3 . That mismatch means someone used a stolen API token to push these versions outside of any automated process. Telnyx doesn’t use PyPI’s trusted publisher (OIDC) feature, which would have bound uploads to a specific GitHub repository and workflow. Without that, a stolen token is a master key. Anyone holding it can push any version from anywhere. The most likely explanation: the PYPI_TOKEN was stolen in a prior credential harvesting operation, possibly through the same chain ...