Notifications
Clear all
Topic starter
02/08/2026 11:51 am
TL;DR: TeamPCP’s Telnyx compromise shows a repeatable supply chain pattern in which stolen credentials from one trusted tool are reused to publish malicious packages across ecosystems, with the Telnyx payload running at import time and exfiltrating data over attacker-controlled infrastructure, according to Aikido. The lesson is that package trust, CI/CD credential scope, and runtime import behavior must be governed together, not as separate controls.
NHIMG editorial — based on content published by Aikido covering the Telnyx PyPI compromise: Popular telnyx package compromised on PyPI by TeamPCP
By the numbers:
- LiteLLM serves roughly 95 million downloads per month and is increasingly deployed as a centralized LLM gateway with access to credentials for OpenAI, Anthropic, AWS Bedrock, GCP VertexAI, and more.
- Telnyx has been downloaed 742k time over the last month.
Questions worth separating out
Q: What breaks when package publish credentials are stolen in a software supply chain?
A: A stolen publish credential turns trusted release infrastructure into an attacker-controlled distribution path.
Q: Why do CI and package-maintainer secrets create outsized supply chain risk?
A: They create outsized risk because one credential can control many packages, many builds, or many environments at once.
Q: What do security teams get wrong about detecting malicious packages?
A: They often focus on known-bad signatures and miss behaviour that looks legitimate until the package runs.
Practitioner guidance
- Classify package publish credentials as high-risk identities Separate maintainer tokens, CI publish tokens, and deployment secrets into explicit privileged identity classes with ownership, expiry, and revocation paths.
- Pin and verify dependencies before execution Require version pinning, hash verification, and provenance checks for packages used in production builds.
- Inspect import-time behavior in sensitive libraries Review modules that execute on import, fetch remote content, or spawn subprocesses, then add detection for those behaviors in build pipelines and developer workstations.
What's in the full analysis
Aikido's full blog covers the operational detail this post intentionally leaves for the source:
- SHA256 hashes and package names for the malicious Telnyx releases, useful for IOC-driven hunting.
- Exact Windows and Linux payload paths, including persistence behavior and exfiltration mechanics.
- The full WAV decoding technique and code path analysis that shows how the payload is unpacked at runtime.
- Specific host and network indicators, including the C2 address and exfiltration header details.
👉 Read Aikido's analysis of the Telnyx PyPI compromise and TeamPCP campaign →
PyPI package compromise: what TeamPCP’s chain means for defenders?
Explore further
02/08/2026 1:00 pm
Package publishing credentials are privileged identities, not operational noise. The Telnyx compromise reinforces a governance gap that many programmes still leave unresolved: release tokens, CI secrets, and maintainer access are treated as support functions rather than high-value identities. Once those credentials are stolen, an attacker can convert trust in the publisher into trust in malicious code. That is why package publishing belongs in IAM and PAM governance, not just DevSecOps hygiene.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- The State of Secrets in AppSec found that the average estimated time to remediate a leaked secret is 27 days, according to The State of Secrets in AppSec.
A question worth separating out:
Q: How should organisations respond when a trusted dependency is found to be malicious?
A: Contain the environment first, then assume adjacent secrets may be exposed. Rotate credentials reachable from the affected machine, check for persistence, review outbound traffic, and rebuild from known-good sources. For package ecosystems, also verify whether publish credentials, CI tokens, or maintainer accounts were reused elsewhere.
👉 Read our full editorial: Telnyx PyPI compromise shows how trusted package chains spread malware
