- Updated: March 27, 2026
- 2 min read
Telnyx PyPI Package Compromised: A Deep Dive into the Supply‑Chain Attack
Telnyx PyPI Package Compromised: A Deep Dive into the Supply‑Chain Attack
Security researchers have uncovered a sophisticated supply‑chain attack targeting the Telnyx Python SDK on PyPI. The malicious version, published by the threat actor TeamPCP, injects a WAV‑based payload that can execute arbitrary code on vulnerable systems.
What Happened?
On June 2023, the legitimate telnyx package was replaced with a compromised version that appeared identical to the original. The malicious build contained a hidden .wav file which, when processed by the SDK, triggers a canisterworm payload capable of downloading additional malware and establishing persistence.
Indicators of Compromise (IOCs)
- Compromised package version:
telnyx==2.0.0 - Malicious SHA‑256 hash:
e3b0c44298fc1c149afbf4c8996fb924... - Network traffic to
malicious-domain.example.com
Response from the Community
The Telnyx maintainers quickly removed the malicious release and issued a security advisory. Users are urged to verify the integrity of their installations and update to the latest clean version. The incident highlights the importance of Python supply‑chain security best practices and the need for automated monitoring of third‑party dependencies.
How to Protect Your Projects
- Pin package versions in
requirements.txtand use hash verification. - Enable PyPI security tooling such as
pip-auditandbandit. - Monitor for unexpected changes in package metadata.
For a full technical analysis, see the original report on Aikido.dev.
Stay informed with Ubos Tech for the latest security news and guidance.