Skip to main content

Telnyx PyPI Package Compromise

Affected packages contain a variant of the ContainerWorm malware, which can exfiltrate secrets and establish persistence

Threat ID:
CC-4762
Threat Severity:
Medium
Published:
27 March 2026 11:32 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Affected packages contain a variant of the ContainerWorm malware, which can exfiltrate secrets and establish persistence

Affected platforms

The following platforms are known to be affected:

Telnyx PyPI package versions 4.87.1 and 4.87.2

Threat details

Introduction

Security researchers have identified a supply-chain compromise affecting specific versions of the Telnyx PyPI package, a widely used software development kit (SDK) for the Telnyx AI Voice Agent service.

The malicious package releases (versions 4.87.1 and 4.87.2) were published between 03:51 UTC and 04:07 UTC on 27 March 2026, containing malicious code similar to the suspected TeamPCP compromises of Trivy (CC-4758) and LiteLLM (CC-4761).

Compromised versions contain malicious code masqueraded as a WAV audio file. This payload has information stealer capabilities that can extract and exfiltrate secrets from an affected device, and also installs a persistence mechanism that survives system reboots. The malicious code runs in any project that imports the Telnyx Python package.

Remediation advice

The NHS England National CSOC recommends impacted organisations review team-telnyx/telnyx-python issue #235 on GitHub and follow the remediation steps detailed below.

Remediation steps

Type Step
Guidance

Check your estate for Telnyx versions 4.87.1 and 4.87.2.​​​​​​​


https://github.com/team-telnyx/telnyx-python/issues/235
Guidance

If you find evidence of the compromised packages, follow the guidance linked below ("What to Do" section) to remove the persistence mechanism and rotate all API keys, database credentials, SSH keys, and any secrets accessible from that machine.

If evidence of compromise is detected, organisations must immediately report this to the NHS England National Cyber Security Operations Centre (CSOC) by calling 0300 303 5222 or emailing [email protected]. 


https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm

Last edited: 27 March 2026 11:32 am