# telnyx compromise

Published articles for telnyx compromise.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## How to protect your organization from the telnyx PyPI compromise

DevFeed: [How to protect your organization from the telnyx PyPI compromise](<https://devfeed.tech/articles/how-to-protect-your-organization-from-the-telnyx-pypi-compromise-13095.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/how-to-protect-your-organization-from-the-telnyx-pypi-compromise>)

Published: 2026-03-27T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [SDKs](<https://devfeed.tech/topics/sdks.md>), [C2](<https://devfeed.tech/topics/c2.md>), [Python](<https://devfeed.tech/topics/python.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [Encryption](<https://devfeed.tech/topics/encryption.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [ssh](<https://devfeed.tech/topics/ssh.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>)

Tags: [api-keys](<https://devfeed.tech/tags/api-keys.md>), [c2](<https://devfeed.tech/tags/c2.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [malware](<https://devfeed.tech/tags/malware.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [pypi](<https://devfeed.tech/tags/pypi.md>), [pypi-attack](<https://devfeed.tech/tags/pypi-attack.md>), [pypi-compromise](<https://devfeed.tech/tags/pypi-compromise.md>), [rsa](<https://devfeed.tech/tags/rsa.md>), [security](<https://devfeed.tech/tags/security.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [teampcp](<https://devfeed.tech/tags/teampcp.md>), [telnyx](<https://devfeed.tech/tags/telnyx.md>), [telnyx-attack](<https://devfeed.tech/tags/telnyx-attack.md>), [telnyx-compromise](<https://devfeed.tech/tags/telnyx-compromise.md>), [trivy](<https://devfeed.tech/tags/trivy.md>)

### AI overview

The article explains that malicious versions 4.87.1 and 4.87.2 of the Telnyx Python SDK were published to PyPI after publishing credentials were compromised. The malware executes at module scope, downloads from a remote C2 server, and uses a WAV file to conceal a Windows persistence binary or credential harvester for Linux and macOS. It recommends immediate removal, version pinning, credential rotation, and persistence checks. The article also attributes the attack to TeamPCP and connects it to a broader coordinated supply chain campaign.

### Source excerpt

Malicious telnyx versions hit PyPI in a wider supply chain attack. Chainguard customers stayed protected by using source-built, verified libraries.