TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files

Overview

TeamPCP, the threat actor behind the supply chain attack targeting Trivy, KICS, and litellm, has now compromised the telnyx Python package by pushing two malicious versions to steal sensitive data. The two versions, 4.87.1 and 4.87.2, published to the Python Package Index (PyPI) repository on March 27, 2026, concealed their credential harvesting capabilities within a .WAV file.

Organisations Involved

The following organisations are mentioned in relation to this incident: Backdoored Telnyx, Hides Stealer, Pushes Malicious Telnyx Versions, Python Package Index.

Multi-Source Coverage

This event has been reported across multiple outlets:

• TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files — thehackernews
• Backdoored Telnyx PyPI package pushes malware hidden in WAV audio — bleepingcomputer

Sources: bleepingcomputer, thehackernews. Aggregated by Cybernews Agency pipeline.