TeamPCP strikes again: Backdoored Telnyx PyPI package delivers malware

Researchers attributed a supply-chain compromise to TeamPCP after malicious Telnyx PyPI releases (4.87.1 and 4.87.2) were published; the backdoored SDK executes on import, retrieves a runtime payload (encoded in WAV audio frames), installs persistence or an infostealer depending on OS, harvests a broad set of secrets (SSH keys, cloud and developer tool credentials, env files, histories, wallets) and can deploy privileged pods to compromise Kubernetes clusters, with stolen data encrypted and exfiltrated. Indicators and cryptographic signatures link the activity to prior TeamPCP compromises and researchers advise treating any detection as a full-environment compromise and rotating all credentials.