Telnyx Python SDK Backdoored on PyPI to Steal Cloud Credentials

TeamPCP published malicious Telnyx Python SDK releases to PyPI that execute on import to harvest cloud, container, and developer credentials, deploy persistent backdoors on Windows and Kubernetes (using WAV steganography and in‑memory loaders), and exfiltrate data to attacker infrastructure (notably 83.142.209.203:8080 with X-Filename:tpcp.tar.gz). The compromise affected widely used code, bypassed build-integrity controls by using a valid PyPI token, was available for several hours, and is part of a broader multi-ecosystem supply-chain campaign; the report provides IoCs and remediation guidance including credential rotation and blocking known C2.