2FA needs to be required for publishing packages. An attacker compromising someone's CI should not give them free reign to publish malicious packages at any time they want.
Telnyx package compromised on PyPI
11–20 of 153 posts
Re: Telnyx package compromised on PyPI
#12I think it's only a matter of time at this point before a devastating supply chain attack occurs.
Supply-chain security is such a dumpster fire, and threat actors are realising that they can use LLMs to organize such attacks.
Re: Telnyx package compromised on PyPI
#13Anthropic/OpenAI could own this space. They should offer a paid service that offers a mirror with LLM scanned and sandbox-evaluated package with their next gen models. Free for individuals, orgs can subscribe to it.
OpenAI just acquired Astral who have an index service called pyx, so they would have a step up.
My understanding though is most corporations that take security seriously either build everything themselves in a sandbox, or use something like JFrog's Artifactory with various security checks, and don't let users directly connect to public indexes. So I'm not sure what the market is.
Re: Telnyx package compromised on PyPI
#14The way I use Telynx is via SIP which is an open protocol. No reason we should be relying on proprietary APIs for this stuff.
On GitHub see my fork runvnc/PySIP. Please let me know if you know if something better for python that is not copy left or rely on some copy left or big external dependency. I was using baresip but it was a pain to integrate and configure with python.
Anyway, after fixing a lot in the original PySIP my version works with Telynx. Not tested on other SIP providers.
Re: Telnyx package compromised on PyPI
#15Anthropic/OpenAI could own this space. They should offer a paid service that offers a mirror with LLM scanned and sandbox-evaluated package with their next gen models. Free for individuals, orgs can subscribe to it.
OpenAI just acquired Astral who have an index service called pyx, so they would have a step up. My understanding though is most corporations that take security seriously either build everything themselves in a sandbox, or use something like JFrog's Artifactory with various security checks, and don't let users directly connect to public indexes. So I'm not sure what the market is.
There’s also virustotal, any.run, probably a few others outside of GitHub/gitlab scans
Re: Telnyx package compromised on PyPI
#16That's not good. Time to raise the package security draw bridge on vibe coders.
Re: Telnyx package compromised on PyPI
#17At this point, I'm not updating anything using Python. Not that I had the option anyway, because everything using Python breaks if you update it. You know they've given up on backward comparability and version control, when the solution is: run everything in a VM, with its own installation. Apparently it's also needed for security, but the VMs aren't really set up to be secure. I don't get why everything math heavy u…
Sounds like you're not familiar with https://docs.astral.sh/uv/ ...
Re: Telnyx package compromised on PyPI
#18They did not even try to hide the payload that much. Every basic checker used by many security companies screams at `exec(base64.b64decode` when grepping code using simple regexes. hexora audit 4.87.1/2026-03-27-telnyx-v4.87.1.zip --min-confidence high --exclude HX4000 warning[HX9000]: Potential data exfiltration with Decoded data via urllib.request.request.Request. ┌─ 2026-03-27-telnyx-v4.87.1.zip:tmp/tmp_79rk5jd/te…
Are there more tools like hexora?
Re: Telnyx package compromised on PyPI
#19Anthropic/OpenAI could own this space. They should offer a paid service that offers a mirror with LLM scanned and sandbox-evaluated package with their next gen models. Free for individuals, orgs can subscribe to it.
Genuinely cannot tell whether this is satire.
Re: Telnyx package compromised on PyPI
#20Has anyone here used Telnyx? I tried to build a product against their API last year and 3 weeks after signing up they banned my account and made it impossible to get an answer as to why or re-enable it.