Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telnyx package compromised on PyPI

telnyx.com

Post reply on HN
Print view View original

21–30 of 153 posts

Re: Telnyx package compromised on PyPI

#21

Post by woodruffw »

viscousviolin wrote: post #8

Is there a notification channel you can subscribe to / look at if you want to stay up to date on compromised PyPI packages?

You can use the PYSEC[1] or OSV[2] databases.

[1]: https://github.com/pypa/advisory-database/blob/main/vulns/te...

[2]: https://osv.dev/vulnerability/MAL-2026-2254

Re: Telnyx package compromised on PyPI

#23

Post by mil22 »

For those using uv, you can at least partially protect yourself against such attacks by adding this to your pyproject.toml:

  [tool.uv]
  exclude-newer = "7 days"
or this to your ~/.config/uv/uv.toml:

  exclude-newer = "7 days"
This will prevent uv picking up any package version released within the last 7 days, hopefully allowing enough time for the community to detect any malware and yank the package version before you install it.

Re: Telnyx package compromised on PyPI

#24

Post by f311a »

m000 wrote: post #18
f311a wrote: post #7

They did not even try to hide the payload that much. Every basic checker used by many security companies screams at `exec(base64.b64decode` when grepping code using simple regexes. hexora audit 4.87.1/2026-03-27-telnyx-v4.87.1.zip --min-confidence high --exclude HX4000 warning[HX9000]: Potential data exfiltration with Decoded data via urllib.request.request.Request. ┌─ 2026-03-27-telnyx-v4.87.1.zip:tmp/tmp_79rk5jd/te…

Are there more tools like hexora?

GuardDog, but it's based on regexes

Re: Telnyx package compromised on PyPI

#25

Post by johndough »

carlsborg wrote: post #5

Anthropic/OpenAI could own this space. They should offer a paid service that offers a mirror with LLM scanned and sandbox-evaluated package with their next gen models. Free for individuals, orgs can subscribe to it.

Judging by curl shutting down its bug bounty program due to AI slop, a likely outcome would be that this mirror has no packages because they are all blocked by false positives.

Re: Telnyx package compromised on PyPI

#26

Post by jlundberg »

We have always been API first rather than SDK first.

Never really thought too much about the security implications but that is of course a benefit too.

Main reasoning for us has been to aim for a really nice HTTP API rather than hide uglyness with an SDK on top.

Re: Telnyx package compromised on PyPI

#29

Post by TZubiri »

ivanvanderbyl wrote: post #20

Has anyone here used Telnyx? I tried to build a product against their API last year and 3 weeks after signing up they banned my account and made it impossible to get an answer as to why or re-enable it.

I like it so far. Did you call phone support at the time and ask about it? I find it's easy enough to get in a call with a human.

Re: Telnyx package compromised on PyPI

#30

Post by viscousviolin »

woodruffw wrote: post #21
viscousviolin wrote: post #8

Is there a notification channel you can subscribe to / look at if you want to stay up to date on compromised PyPI packages?

You can use the PYSEC[1] or OSV[2] databases. [1]: https://github.com/pypa/advisory-database/blob/main/vulns/te... [2]: https://osv.dev/vulnerability/MAL-2026-2254

Thank you!
Post reply on HN