TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files

TeamPCP compromised the telnyx PyPI package by publishing malicious versions (4.87.1 and 4.87.2) that embed credential-harvesting payloads inside WAV files using audio steganography; Windows hosts receive a persistent binary dropped to Startup (msbuild.exe) while Linux/macOS perform a fast in-memory harvest and encrypted exfiltration to 83.142.209.203:8080. The incident is part of a wider supply-chain campaign targeting developer and CI tooling, and users are advised to downgrade, rotate secrets, scan environments, and block the C2.