Popular telnyx package compromised on PyPI by TeamPCP
Summary
The article reports a compromise of the Telnyx Python SDK on PyPI as part of TeamPCP's ongoing supply chain campaign. It details the multi-ecosystem attack pattern, including a WAV-steganography payload that exfiltrates data, with Windows and Linux/macOS variants and explicit IOCs and remediation steps. It emphasizes immediate mitigations like pinning dependencies, rotating credentials, and monitoring for suspicious network activity.