--- title: "Telnyx Python SDK Security Notice: Malicious PyPI Versions Identified (March 2026)" canonical: https://telnyx.com/resources/telnyx-python-sdk-supply-chain-security-notice-march-2026 --- # Telnyx Python SDK Security Notice: Malicious PyPI Versions Identified (March 2026) [Back to blog](https://telnyx.com/resources) **Telnyx** # Telnyx Python SDK: Supply Chain Security Notice Unauthorized versions of the Telnyx Python SDK were briefly published to PyPI as part of a broader supply chain attack. Learn which versions were affected, who is impacted, and the steps to secure your environment. By [David Casem](https://telnyx.com/authors/david-casem) ## Summary On March 27, 2026 at 03:51:28 UTC, two unauthorized versions of the Telnyx Python SDK were published to PyPI: versions 4.87.1 and 4.87.2\. Both versions contained malicious code. Both were quarantined by 10:13 UTC the same day. This incident is part of a broader supply chain campaign that has also affected Trivy, Checkmarx, and LiteLLM. **The Telnyx platform, APIs, and infrastructure were not compromised.** This incident was limited to the PyPI distribution channel for the Python SDK. ## Affected Versions | Version | Published | | -------------- | ---------------------------- | | telnyx==4.87.1 | 03:51:28 UTC, March 27, 2026 | | telnyx==4.87.2 | Shortly after | Both versions have been removed from PyPI. ## Who Is Affected You may be affected if: * You installed or upgraded the telnyx Python package between 03:51 UTC and 10:13 UTC on March 27, 2026 * You ran pip install telnyx without pinning a version and received 4.87.1 or 4.87.2 * A dependency in your project pulled in telnyx as a transitive, unpinned dependency ## Who Is NOT Affected * You are running version 4.87.0 or earlier * You did not install or upgrade the telnyx package between 03:51 UTC and 10:13 UTC on March 27 * You are using the Telnyx REST API directly without the Python SDK ## How to Check Run the following command: ``` pip show telnyx ``` **If the version shown is 4.87.1 or 4.87.2, treat the environment as compromised.** ## What to Do If Affected 1. Downgrade immediately: ``` pip install telnyx==4.87.0 ``` 1. Rotate all secrets accessible from the affected environment: * API keys * Database credentials * Cloud provider tokens * SSH keys * Any secrets stored in environment variables or configuration files 1. Audit your systems for outbound connections to attacker infrastructure (see IOCs below) 2. Review CI/CD pipelines and Docker builds that may have pulled the compromised version ## Indicators of Compromise | Type | Value | | --------------- | ---------------------------------- | | C2 server | 83.142.209.203:8080 | | Exfil technique | WAV steganography payload delivery | Additional IOCs will be published as the investigation confirms them. ## What Was NOT Compromised The Telnyx platform, voice services, messaging infrastructure, networking, SIP, AI inference, and all production APIs were not affected. The SDK is a client library that wraps public APIs. It has no privileged access to Telnyx infrastructure. No customer data was accessed through this incident. ## What We Are Doing * Malicious versions removed from PyPI * Investigating how publishing credentials were obtained ## Related Incidents This attack is part of a multi-week supply chain campaign: * [Trivy compromise](https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know) (March 19, 2026) * [LiteLLM compromise](https://docs.litellm.ai/blog/security-update-march-2026) (March 24, 2026) ## Questions? Contact [\[email protected\]](https://telnyx.com/cdn-cgi/l/email-protection#6417010711160d101d241001080a1d1c4a070b09) if you have questions about this incident or need assistance determining if your environment was affected. Share on Social ## Jump to: [Summary](#summary)[Affected Versions](#affected-versions)[Who Is Affected](#who-is-affected)[Who Is NOT Affected](#who-is-not-affected)[How to Check](#how-to-check)[What to Do If Affected](#what-to-do-if-affected)[Indicators of Compromise](#indicators-of-compromise)[What Was NOT Compromised](#what-was-not-compromised)[What We Are Doing](#what-we-are-doing)[Related Incidents](#related-incidents)[Questions?](#questions) ## Sign up for emails of our latest articles and news [Start building](https://telnyx.com/sign-up) Latest from Telnyx * [**Inference**Inference cost explained: why your AI bill rises as prices fall![Eli Mogul](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/Eli_Mogul_1de9939dcb.png?width=96&format=webp)By Eli Mogul29, Oct 2026](https://telnyx.com/resources/inference-cost) * [**Verify API**The best phone verification APIs for developers in 2026![Serhii](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/_DSC8799-6.jpg?width=96&format=webp)By Serhii Omelchenko29, Oct 2026](https://telnyx.com/resources/best-phone-verification-apis) * [**Insights and Resources**The best transactional email API providers for developers in 2026![Deniz Yakışıklı](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/Deniz_Yakisikli_6b7b420ed4.png?width=96&format=webp)By Deniz Yakışıklı28, Oct 2026](https://telnyx.com/resources/best-transactional-email-api) * [**Telnyx**Inference benchmarks: which numbers predict latency on your traffic![Eli Mogul](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/Eli_Mogul_1de9939dcb.png?width=96&format=webp)By Eli Mogul27, Oct 2026](https://telnyx.com/resources/inference-benchmarks) * [**Networking**AI data residency vs sovereign AI: what to check in vendors![Eli Mogul](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/Eli_Mogul_1de9939dcb.png?width=96&format=webp)By Eli Mogul27, Oct 2026](https://telnyx.com/resources/sovereign-ai-vs-data-residency) * [**Conversational AI**Data Sovereignty for Voice AI in Australia![Deniz Yakışıklı](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/Deniz_Yakisikli_6b7b420ed4.png?width=96&format=webp)By Deniz Yakışıklı27, Oct 2026](https://telnyx.com/resources/australia-data-sovereignty-voice-ai) ### Ask AI * [![GPT](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/chatgpt_icon-ea55e09d.jpeg?width=92&format=webp)](https://chat.openai.com/?q=What makes Telnyx's global network different, breakdown call quality for normal phone calls and voice AI calls.) * [![Claude](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/claude_icon-c7c8eef3.webp?width=92&format=webp)](https://claude.ai/new?q=What makes Telnyx's global network different, breakdown call quality for normal phone calls and voice AI calls.) * [![Perplexity](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/perplexity_icon-cd5b74f1.webp?width=92&format=webp)](https://www.perplexity.ai/search?q=What makes Telnyx's global network different, breakdown call quality for normal phone calls and voice AI calls.) * [![Gemini](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/gemini_icon-4ff1cbf4.webp?width=92&format=webp)](https://www.google.com/search?udm=50&aep=11&q=What makes Telnyx's global network different, breakdown call quality for normal phone calls and voice AI calls.) * [![Grok](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/grok_icon-e588e5bd.webp?width=92&format=webp)](https://x.com/i/grok?text=What makes Telnyx's global network different, breakdown call quality for normal phone calls and voice AI calls.)