TeamPCP, a prolific supply chain threat actor, compromised the official Telnyx Python SDK on PyPI by publishing two malicious versions (4.87.1 and 4.87.2) on March 27, 2026. The Telnyx SDK is widely used for VoIP, messaging, fax, and IoT connectivity, averaging over 742,000 downloads per month.

The sole modified file was telnyx/_client.py, with exactly 74 lines of malicious code injected at three locations: malicious imports at lines 4-16 (subprocess, tempfile, wave, urllib.request, base64), a 4,436-character base64-encoded payload variable '_p' at line 459, and attack functions setup() and FetchAudio() appended after legitimate class definitions at lines 7761-7817. The malicious code executes at module scope during import — no explicit function calls or installation hooks are required.

The initial version 4.87.1 (published at 03:51 UTC) contained a casing bug (Setup() vs setup()) causing a NameError that prevented execution. TeamPCP corrected this within 16 minutes, releasing version 4.87.2 at 04:07 UTC with a single-line fix making both attack paths functional. PyPI quarantined both versions at 10:13 UTC, creating an approximately 6-hour window of active exploitation.

The attack employs a novel steganographic delivery mechanism using WAV audio files. On Linux/macOS, the malware spawns a detached subprocess that downloads ringtone.wav from the C2 server at 83.142.209.203:8080. The WAV file is a valid audio container where frame data contains base64-encoded payloads instead of actual audio. Extraction follows a three-step process: base64-decode the WAV frame data, extract the first 8 bytes as the XOR key, then XOR-decrypt the remaining bytes using repeating-key XOR to recover the executable payload.

On Linux/macOS, the decoded payload is a comprehensive credential harvester that targets SSH keys, cloud credentials (AWS, GCP, Azure), Docker and npm authentication tokens, Git credentials, Vault secrets, database credentials, environment variables, .env files, shell histories, and cryptocurrency wallet data. Stolen data is encrypted using a multi-layer scheme: a random AES-256-CBC session key generated via openssl rand, data encrypted with AES-256-CBC using PBKDF2 key derivation, and the session key wrapped with an attacker-controlled RSA-4096 public key using OAEP padding. The encrypted archive is exfiltrated as tpcp.tar.gz via HTTP POST to the C2 server. The harvester operates within a self-destructing temporary directory, leaving near-zero forensic artifacts. Linux persistence is established via ~/.config/audiomon/audiomon.py with a systemd user service at ~/.config/systemd/user/audiomon.service.

If Kubernetes is detected on the infected system, the malware enumerates cluster secrets using compromised service account tokens and deploys privileged pods to every node in the kube-system namespace. These pods mount the host root filesystem at /host with hostPID, hostNetwork, and privileged: True, then perform a chroot operation into the host filesystem to install persistence mechanisms directly on nodes. Pod names follow the pattern node-setup-*, with containers named kamikaze, provisioner, host-provisioner-iran, and host-provisioner-std.

On Windows, the malware downloads hangup.wav from the same C2 server, extracts an XOR-obfuscated executable from the audio frames, and drops it as msbuild.exe in the Windows Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\) — masquerading as the legitimate Microsoft Build Engine. A hidden .lock file prevents re-execution within a 12-hour window. The executable is launched with the CREATE_NO_WINDOW flag for silent operation.

Attribution to TeamPCP is confirmed with high confidence through three overlapping indicators: an identical RSA-4096 public key shared byte-for-byte with the LiteLLM PyPI compromise (March 24, 2026), the tpcp.tar.gz archive naming convention and X-Filename header (TeamPCP signature), and an identical AES-256-CBC + RSA OAEP encryption pipeline. The compromise is part of a broader TeamPCP campaign spanning March 19-27, 2026, targeting Trivy (CVE-2026-33634), npm (CanisterWorm, 46+ packages), Checkmarx GitHub Actions, LiteLLM PyPI, and Telnyx PyPI.

Root cause analysis indicates TeamPCP obtained the PyPI API token (PYPI_TOKEN) through prior credential harvesting, likely from the LiteLLM compromise. No malicious commits exist in the GitHub repository — all pushes came from legitimate automation (stainless-app[bot]). The malicious uploads used twine/6.2.0 instead of the expected rye CI tool, and no corresponding GitHub release tags exist for versions 4.87.1 or 4.87.2. The Telnyx PyPI project did not have trusted publishers (OIDC) configured, which would have prevented unauthorized uploads.

The malware does not verify downloaded WAV files cryptographically before execution, creating an additional risk where man-in-the-middle attackers could inject alternative payloads targeting TeamPCP-compromised systems.