Telnyx Python SDK Compromised on PyPI: Malware Delivered via Steganography in WAV Files, Mitigation Strategies Discussed
Incident Overview The Telnyx Python SDK on the Python Package Index (PyPI) was compromised in a sophisticated supply chain attack executed by the threat actor TeamPCP. Malicious versions of the SDK...
Source: DEV Community
Incident Overview The Telnyx Python SDK on the Python Package Index (PyPI) was compromised in a sophisticated supply chain attack executed by the threat actor TeamPCP. Malicious versions of the SDK (4.87.1 and 4.87.2) were uploaded to PyPI, engineered to execute arbitrary code immediately upon import, ensuring cross-platform compatibility. The attack’s technical sophistication is exemplified by its payload delivery mechanism: WAV steganography, which embeds malicious data within the frame metadata of ostensibly benign audio files. Below is a detailed technical analysis of the attack: Upon import, the compromised package fetches a .wav file from a command-and-control (C&C) server located at 83.142.209.203:8080. The WAV file maintains structural validity, concealing malicious data within its frame metadata. The malware extracts the hidden data from the frame metadata, applies base64 decoding, and performs an XOR operation using the initial bytes as the encryption key. This process re
