# Supply Chain Threat Actor TeamPCP Targets Python Ecosystem With Poisoned Telnyx Package
A sophisticated threat group known as TeamPCP has expanded its supply chain attack campaign by compromising the widely-used telnyx Python package, injecting malicious code designed to harvest sensitive credentials from developers and systems that install the affected versions. The campaign represents an escalation in the group's targeting strategy, which has already claimed several high-profile infrastructure tools as victims.
## The Threat
On March 27, 2026, two malicious versions of the telnyx package—versions 4.87.1 and 4.87.2—were published to the Python Package Index (PyPI), the primary distribution platform for Python libraries. The packages were engineered to steal sensitive authentication credentials and configuration data from systems where they were installed. What distinguishes this particular attack is the use of obfuscation: the malicious payload was concealed within a .WAV audio file embedded within the package, a technique designed to evade automated security scanning and human code review.
The telnyx package provides Python developers with easy integration to the Telnyx communications platform, which handles SMS messaging, voice calls, and other telecommunications services. Given its role in production systems across numerous organizations, the compromise posed significant risk to any developer or organization that updated to the poisoned versions during the window of availability.
## Background and Context
TeamPCP is not a new threat actor. The group has demonstrated sophisticated capabilities and operational security practices across multiple high-impact campaigns. Prior to targeting the telnyx package, TeamPCP was linked to the compromise of critical open-source security tools, including Trivy (a container vulnerability scanner), KICS (an infrastructure-as-code security tool), and litellm (a language model integration library).
This pattern of attacks reveals a deliberate strategy: TeamPCP targets widely-adopted infrastructure and developer tools—projects with substantial download volumes and deep integration into enterprise development workflows. By poisoning these upstream dependencies, the group gains access to organizations through their own development pipelines, effectively bypassing many external security controls.
The telnyx compromise fits neatly into this established pattern. The package benefits from significant adoption among developers building communication-heavy applications, particularly in the startup and fintech sectors where Telnyx's services are common infrastructure choices.
## Technical Details
### The Attack Mechanism
Rather than embedding obfuscated Python code directly into the package source, TeamPCP employed a stealthier approach: the malicious code was hidden within a .WAV file, a common audio format. This technique offers several tactical advantages. First, automated security scanners that focus on code analysis often give less scrutiny to binary or media files included in Python packages. Second, during casual code review, security researchers may overlook non-code artifacts, especially media files that appear to serve legitimate purposes (such as sample audio for telecommunications testing). Third, extracting and executing code from a .WAV file creates an additional obfuscation layer that makes static analysis more difficult.
The malicious payload itself functioned as a credential stealer, designed to extract authentication tokens, API keys, and configuration information from the infected system. Depending on the scope of the infection, this could have compromised:
Once exfiltrated, this information would provide attackers with direct access to the victim organization's infrastructure, communication systems, and potentially downstream applications and services.
## Scope and Impact
PyPI security responses depend heavily on the speed at which the community identifies and reports malicious packages. In this instance, the poisoned versions remained available for a critical period before being flagged and removed. The exact duration of availability and the number of installations during that window—key metrics for assessing true impact—determined the scope of the compromise.
Organizations most at risk from this specific attack include:
Even organizations using the legitimate telnyx package may face residual risk if their systems updated automatically or if developers pulled the poisoned versions into local development environments and generated compiled artifacts.
## Response and Remediation
### Immediate Actions
Organizations should:
### Longer-Term Considerations
## Technical Recommendations
For Package Users:
For the Open Source Community:
## HackWire Analysis
The TeamPCP campaign represents a maturing threat landscape where sophisticated attackers understand that directly compromising end-user systems is far less efficient than poisoning the supply chain. By targeting shared dependencies, a single successful compromise can provide access to dozens or hundreds of downstream organizations with minimal additional effort.
What makes this campaign particularly notable is the refinement of obfuscation techniques. The use of .WAV files as a vehicle for malicious code suggests that threat actors have analyzed defensive workflows and specifically engineered attacks to evade them. This adaptation indicates that supply chain security defenses are having some effect—enough that attackers feel compelled to improve their tradecraft.
Organizations cannot rely solely on external security vendors to protect against these threats. The telnyx compromise, like its predecessors, ultimately required human vigilance and rapid community response. For companies building on open-source infrastructure, the lesson is clear: dependency management is now a critical security function, not merely an operational convenience.