# Telnyx Python SDK hides credential stealer in WAV-file steganography

> TeamPCP published malicious `telnyx` 4.87.1 and 4.87.2 to PyPI on 27 March 2026 (~670k monthly downloads). Trojanised `_client.py` downloads steganographic payloads disguised as `.wav` files over plaintext HTTP, extracts the credential stealer, and persists. Windows variant drops `msbuild.exe` to the Startup folder; Linux variant uses a user-level systemd service. AES-256-CBC + RSA-4096 envelope for exfil.

- Published: 2026-03-27
- Severity: critical
- Kind: Compromise - A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
- Ecosystems: PyPI
- Scope: 1 package, 2 compromised versions
- Tags: maintainer-takeover, credential-theft, obfuscation, infostealer
- Threat actor: TeamPCP
- Detected by: JFrog
- Incident ID: pypi-2026-03-27-telnyx-teampcp

## Affected packages (1)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [telnyx](https://dependencywatch.io/package/pypi/telnyx) | PyPI | 4.87.1, 4.87.2 |

## What happened

On 27 March 2026 the threat group **TeamPCP** published two trojanised releases of `telnyx` (`4.87.1` and `4.87.2`) - the official Python SDK for the Telnyx voice/SMS platform with roughly 670k monthly downloads. The malicious code lives inside `telnyx/_client.py` and runs the moment any consumer imports the SDK.

The loader pulls steganographic payloads from `83.142.209.203:8080/hangup.wav` and `/ringtone.wav` over plaintext HTTP. Audio frames hide a base64 + XOR-encoded blob that decrypts into a credential stealer. Exfiltration uses an AES-256-CBC payload wrapped in an RSA-4096 envelope, tagged with the header `X-Filename: tpcp.tar.gz`.

Persistence is OS-specific:

- Windows drops `msbuild.exe` into `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\` and uses an `.lock` companion file.
- Linux installs a user-level `audiomon.service` systemd unit under `~/.config/systemd/user/` backed by `~/.config/audiomon/`.

This is TeamPCP's second high-impact campaign in a week - JFrog tied the same actor to the earlier `litellm` PyPI compromise. PyPI quarantined both versions, but any environment that resolved `telnyx>=4.87.1` during the live window should treat developer credentials and host metadata as compromised.

## Impact

- Persistent Windows execution as msbuild.exe in Startup
- Linux user-level systemd persistence (audiomon.service)
- Credential and host-metadata exfiltration to attacker C2
- Targets developers integrating with Telnyx voice/SMS APIs

## What to do

1. Downgrade to `telnyx` 4.87.0 or earlier
2. Delete `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\msbuild.exe`
3. Remove `~/.config/audiomon/` and `~/.config/systemd/user/audiomon.service`
4. Block 83.142.209.203:8080 and the `/hangup.wav`, `/ringtone.wav` URIs

## Check your own dependencies

- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [TeamPCP strikes again: Telnyx popular library hit](https://research.jfrog.com/post/team-pcp-strikes-again-telnyx-popular-library-hit/) - JFrog
- [telnyx-python issue #235 - malicious release discussion](https://github.com/team-telnyx/telnyx-python/issues/235) - GitHub

---

Canonical page: https://dependencywatch.io/incident/pypi-2026-03-27-telnyx-teampcp
Markdown version: https://dependencywatch.io/incident/pypi-2026-03-27-telnyx-teampcp.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).