---
title: "GHSA-955r-262c-33jc: Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2"
url: https://erroneo.us/security/ghsa/GHSA-955r-262c-33jc/
description: "GHSA-955r-262c-33jc (critical, PyPI): Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2. Summary On March 27, 2026, a threat actor used…"
type: advisory
section: "Security Digest"
date_published: 2026-03-30
date_modified: 2026-03-30
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-955r-262c-33jc"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-955r-262c-33jc: Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2

## Affected packages

- PyPI `telnyx` >= 4.87.1, <= 4.87.2 → fixed: none listed

## Details

Summary On March 27, 2026, a threat actor used compromised PyPI credentials to publish malicious versions 4.87.1 and 4.87.2 of the telnyx Python package directly to PyPI. These versions contain credential-stealing malware and were not published through the legitimate GitHub release pipeline. Exposure Window | Version | Published (UTC) | Quarantined (UTC) | Exposure | |---------|-----------------|-------------------|----------| | 4.87.1 (broken) | 2026-03-27 03:51 | 2026-03-27 10:13 | 6h 22m | | 4.87.2 (functional) | 2026-03-27 04:07 | 2026-03-27 10:13 | 6h 6m | Both versions were quarantined by PyPI at 2026-03-27 10:13 UTC. Note: Version 4.87.1 contained a typo that prevented the malware from executing. Only 4.87.2 was fully functional. Who Is Affected You may be affected if: - You installed or upgraded the telnyx Python package between 03:51 UTC and 10:13 UTC on March 27, 2026 - You ran pip install telnyx without pinning a version and received 4.87.1 or 4.87.2 - A dependency in your project pulled in telnyx as a transitive, unpinned dependency You are NOT affected if: - You pinned to version 4.87.0 or earlier - You installed before March 27, 2026 and did not upgrade - You built from GitHub source (malicious code was never committed to the repository) Attack Details Root Cause The attacker obtained the PyPI API token and uploaded malicious packages directly to PyPI, bypassing the GitHub release pipeline entirely. No malicious commits exist in the GitHub repository. Malicious Behavior The malware is injected into telnyx/client.py (74 additional lines) and executes on import telnyx: Linux/macOS: 1. Spawns detached subprocess to survive parent exit 2. Downloads payload hidden inside WAV audio file (steganography) from C2 3. Harvests credentials: SSH keys, AWS/GCP/Azure creds, Kubernetes tokens, Docker configs, .env files, database credentials, crypto wallets 4. If Kubernetes access found, deploys privileged pods to all nodes for lateral movement 5. Encrypts with AES-256-CBC + RSA-4096, exfiltrates to C2 Windows: 1. Downloads binary hidden inside WAV file from C2 2. Drops as msbuild.exe in Startup folder for persistence 3. Executes with hidden window Version Differences | Version | Status | Notes | |---------|--------|-------| | 4.87.1 | Broken | Typo: Setup() instead of setup() caused…

## Sources

- [GitHub Advisory GHSA-955r-262c-33jc](https://github.com/advisories/GHSA-955r-262c-33jc)
- [github.com](https://github.com/team-telnyx/telnyx-python/security/advisories/GHSA-955r-262c-33jc)
- [github.com](https://github.com/team-telnyx/telnyx-python/issues/235)
- [ramimac.me](https://ramimac.me/teampcp)
- [endorlabs.com](https://www.endorlabs.com/learn/teampcp-strikes-again-telnyx-compromised-three-days-after-litellm)

---
Source page: https://erroneo.us/security/ghsa/GHSA-955r-262c-33jc/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt