A Telnyx VoIP platform разработчики warn users about the compromise of the popular (756 thousand downloads per month) telnyx package in the PyPI repository implementing an SDK for accessing the Telnyx API.
In Linux, the malicious code activates upon importing the module and searches for and sends SSH keys, credentials, environment variable content, API access tokens, AWS, GCP, Azure, and K8s cloud service connection parameters, cryptocurrency wallet keys, database passwords, etc. The discovered data is encrypted using AES-256-CBC + RSA-4096 algorithms and sent via an HTTP POST request to an external host.
Forrás: linux.org.ru
