A supply chain attack has compromised the popular Python package telnyx on PyPI. The library, which saw over 740,000 downloads in the last month alone, was found to contain malicious code designed to steal sensitive data from Windows, Linux, and macOS environments.
Vulnerable Versions
The compromised versions are 4.87.1 and 4.87.2. The malicious payload executes automatically as soon as the library is imported into a project.
Required Actions
- Uninstall: Remove versions 4.87.1 and 4.87.2 of the telnyx package immediately.
- Rotate Credentials: Change all API keys, passwords, and tokens used in affected environments.
- Windows Users: Check the
Startupfolder for an unauthorizedmsbuild.exefile and delete it if present.
Always verify package integrity and monitor for unauthorized updates in your development pipeline.
