Telnyx package hit by network compromise
Incident
Summary
Hide ▲
Show ▼
The Telnyx package on PyPI was compromised, and malicious releases began executing at import, putting downstream developers at risk of secret theft. The bad uploads included 4.87.1 and 4.87.2, and the payload was later fixed after an initial broken release. Any environment that imported the tainted package should be treated as compromised and its secrets rotated.
Related Happenings
@Injectivelabs/[email protected] wallet-stealing package
Malware Activity
H score30
First: 10.07.2026 20:29
Last: 10.07.2026 20:29
Sources 1
About this happening:
The malicious @injectivelabs/[email protected] package is a wallet-stealing malware activity that can expose private keys and mnemonic seed phrases when library functions...
@Injectivelabs/[email protected] wallet-stealing package
Malware ActivityAbout this happening: The malicious @injectivelabs/[email protected] package is a wallet-stealing malware activity that can expose private keys and mnemonic seed phrases when library functions...
Laravel Lang credential-stealer dropper delivered through malicious Composer packages
Malware Activity
H score22
First: 23.05.2026 23:48
Last: 23.05.2026 23:48
Sources 1
About this happening:
A malicious Composer payload in Laravel Lang packages now threatens Linux, macOS, and Windows developers with credential theft. The injected `src/helpers.php` dropper...
Laravel Lang credential-stealer dropper delivered through malicious Composer packages
Malware ActivityAbout this happening: A malicious Composer payload in Laravel Lang packages now threatens Linux, macOS, and Windows developers with credential theft. The injected `src/helpers.php` dropper...
Shai-Hulud worm clone activity on NPM
Malware Activity
H score69
First: 18.05.2026 12:45
Last: 18.05.2026 12:45
Sources 1
About this happening:
The Shai-Hulud malware activity has continued to evolve across the npm supply chain and related developer ecosystems. It first infected npm packages in September 202...
Shai-Hulud worm clone activity on NPM
Malware ActivityAbout this happening: The Shai-Hulud malware activity has continued to evolve across the npm supply chain and related developer ecosystems. It first infected npm packages in September 202...
TanStack hit by network compromise
Incident
H score29
First: 12.05.2026 17:45
Last: 12.05.2026 17:45
Sources 1
About this happening:
TanStack was hit by a package compromise on May 11, 2026, when attackers published 84 malicious versions across 42 @tanstack/* packages and abused the release...
TanStack hit by network compromise
IncidentAbout this happening: TanStack was hit by a package compromise on May 11, 2026, when attackers published 84 malicious versions across 42 @tanstack/* packages and abused the release...
Latest development: 21.05.2026 11:00
On May 17, 2026, Grafana Labs said an unauthorized attacker had downloaded its codebase after accessing the firm's GitHub environment, and the company later said additional internal operational information and business contact names and email addresses were taken from its GitHub repositories; Grafana Labs said there was no indication that customer production systems or the Grafana Cloud platform were compromised.
Shai-Hulud supply-chain campaign spreading via stolen CI/CD credentials
Campaign
H score56
First: 12.05.2026 14:29
Last: 12.05.2026 14:29
Sources 1
About this happening:
GitHub said it removed more than 500 compromised npm packages in September 2025 and moved to harden publishing after early Shai-Hulud activity. In May 2026, researcher...
Shai-Hulud supply-chain campaign spreading via stolen CI/CD credentials
CampaignAbout this happening: GitHub said it removed more than 500 compromised npm packages in September 2025 and moved to harden publishing after early Shai-Hulud activity. In May 2026, researcher...
Timeline
-
27.03.2026 23:13 2 articles · 3mo ago
Telnyx package hit by network compromise
Initial DisclosureThe first malicious Telnyx release, 4.87.1, was uploaded at 03:51 UTC with a payload that did not function correctly. About an hour later, the attacker republished the package as 4.87.2 to fix the broken payload.
Show sources
- Backdoored Telnyx PyPI package pushes malware hidden in WAV audio — www.bleepingcomputer.com — 27.03.2026 23:13
- Backdoored Telnyx PyPI package pushes malware hidden in WAV audio — www.bleepingcomputer.com — 27.03.2026 23:13