GHSA-955r-262c-33jc Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2
SummaryOn March 27, 2026, a threat actor used compromised PyPI credentials to publish malicious versions 4.87.1 and 4.87.2 of the `telnyx` Python package directly to PyPI. These versions contain credential-stealing malware and were not published through the legitimate GitHub release pipeline.Exposure Window| Version | Published (UTC) | Quarantined (UTC) | Exposure |
|---------|-----------------|-------------------|----------|
| 4.87.1 (broken) | 2026-03-27 03:51 | 2026-03-27 10:13 | 6h 22m |
| 4.87.2 (functional) | 2026-03-27 04:07 | 2026-03-27 10:13 | 6h 6m |**Both versions were quarantined by PyPI at 2026-03-27 10:13 UTC.****Note:** Version 4.87.1 contained a typo that prevented the malware from executing. Only 4.87.2 was fully functional.Who Is AffectedYou may be affected if:You installed or upgraded the `telnyx` Python package between 03:51 UTC and 10:13 UTC on March 27, 2026You ran `pip install telnyx` without pinning a version and received 4.87.1 or 4.87.2A dependency in your project pulled in `telnyx` as a transitive, unpinned dependencyYou are NOT affected if:You pinned to version 4.87.0 or earlierYou installed before March 27, 2026 and did not upgradeYou built from GitHub source (malicious code was never committed to the repository)Attack DetailsRoot CauseThe attacker obtained the PyPI API token and uploaded malicious packages directly to PyPI, bypassing the GitHub release pipeline entirely. No malicious commits exist in the GitHub repository.Malicious BehaviorThe malware is injected into `telnyx/_client.py` (74 additional lines) and executes on `import telnyx`:**Linux/macOS:**Spawns detached subprocess to survive parent exitDownloads payload hidden inside WAV audio file (steganography) from C2Harvests credentials: SSH keys, AWS/GCP/Azure creds, Kubernetes tokens, Docker configs, .env files, database credentials, crypto walletsIf Kubernetes access found, deploys privileged pods to all nodes for lateral movementEncrypts with AES-256-CBC + RSA-4096, exfiltrates to C2**Windows:**Downloads binary hidden inside WAV file from C2Drops as `msbuild.exe` in Startup folder for persistenceExecutes with hidden windowVersion Differences| Version | Status | Notes |
|---------|--------|-------|
| 4.87.1 | Broken | Typo: `Setup()` instead of `setup()` caused NameError |
| 4.87.2 | Functional | Attacker uploaded 16 minutes later to fix their own casing error; full attack chain operational |Verified Safe Version| Version | File | SHA-256 |
|---------|------|--------|
| **4.87.0** | `telnyx-4.87.0-py3-none-any.whl` | `5aeb8172c29ade224e6c2d166713f304596aa21e3dbfa5b6b2b028e6997f6bd2` |
| **4.87.0** | `telnyx-4.87.0.tar.gz` | `3f093a85c313c2b779594f99fc07f453f1a7fd8785878d963688c531ff94d03a` |Recommended Actions1. Check If You Are Affected2. Remove Compromised Versions3. Rotate All Potentially Exposed SecretsIf there is any possibility that version 4.87.1 or 4.87.2 was installed in your environment, treat all accessible secrets as compromised:SSH keysAWS/GCP/Azure credentialsKubernetes tokens and service accountsDocker registry credentialsDatabase passwordsAPI keys in .env filesTelnyx API keys4. Check for Persistence (Linux/macOS)5. Check for Persistence (Windows)6. Pin to Safe VersionOr in requirements.txt:Indicators of CompromiseMalicious Package Hashes| File | SHA-256 |
|------|--------|
| `telnyx-4.87.1-py3-none-any.whl` | `7321caa303fe96ded0492c747d2f353c4f7d17185656fe292ab0a59e2bd0b8d9` |
| `telnyx-4.87.2-py3-none-any.whl` | `cd08115806662469bbedec4b03f8427b97c8a4b3bc1442dc18b72b4e19395fe3` |Network| IoC | Type |
|-----|------|
| `83.142.209.203` | C2 IP address |
| `http://83.142.209.203:8080/ringtone.wav` | Payload endpoint (Linux/macOS) |
| `http://83.142.209.203:8080/hangup.wav` | Payload endpoint (Windows) |
| `http://83.142.209.203:8080/raw` | Persistence polling endpoint |Filesystem| Path | Platform | Purpose |
|------|----------|--------|
| `~/.config/audiomon/audiomon.py` | Linux/macOS | Persistence implant |
| `~/.config/systemd/user/audiomon.service` | Linux | Persistence service |
| `/tmp/.initd_state` | Linux/macOS | State tracking |
| `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\msbuild.exe` | Windows | Persistence binary |
| `msbuild.exe.lock` | Windows | 12-hour cooldown lock |ExfiltrationArchive name: `tpcp.tar.gz`HTTP header: `X-Filename: tpcp.tar.gz`Encryption: AES-256-CBC + RSA-4096 OAEPAttributionThis attack is attributed to **TeamPCP** with high confidence based on:Identical RSA-4096 public key as the LiteLLM compromise (March 24, 2026)`tpcp.tar.gz` archive naming convention (TeamPCP signature)Identical AES-256-CBC + RSA OAEP encryption schemeSame credential harvesting targets and techniquesRSA Key Hash:PEM SHA-256: `4eceb569b4330565b93058465beab0e6d5ea09cfba8e7f29d7be1b5a2abd958a`Resourceshttps://github.com/team-telnyx/telnyx-python/issues/235https://www.endorlabs.com/learn/teampcp-strikes-again-telnyx-compromised-three-days-after-litellmhttps://ramimac.me/teampcp