TeamPCP Supply Chain Attack Targets PyPI Ecosystem (infosecurity-magazine.com)

• Detection of malicious code masquerading as Telnyx integrations.
• Execution of credential harvesting scripts upon package installation.
• Highlights the ongoing risk of typosquatting in open-source registries.

"Security researchers at Socket and Endor Labs have detected a new malicious campaign by the threat actor TeamPCP targeting the PyPI ecosystem. The attack involves the distribution of a malicious package designed to spoof Telnyx services, aimed at harvesting developer credentials. This highlight emphasizes the systemic risk within public software registries that serve as the backbone for international digital infrastructure."