Subj : The telnyx packages on PyPI have been compromised
To   : All
From : LWN.net
Date : Sat Mar 28 2026 06:40:08

The SafeDep blog reports
that compromised versions of the telnyx package have been found in the PyPI
repository:

Two versions of telnyx (4.87.1 and 4.87.2) published to
	PyPI on March 27, 2026 contain malicious code injected into
	telnyx/_client.py. The telnyx package averages over 1 million
	downloads per month (~30,000/day), making this a high-impact
	supply chain compromise. The payload downloads a second-stage
	binary hidden inside WAV audio files from a remote server, then
	either drops a persistent executable on Windows or harvests
	credentials on Linux/macOS.

https://lwn.net/Articles/1065059/
--- SBBSecho 3.37-Linux
 * Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (86:200/23)

.