{"id":166627,"date":"2026-03-29T11:12:54","date_gmt":"2026-03-29T09:12:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/komprometacziya-pypi-paketa-telnyx"},"modified":"2026-03-29T11:12:54","modified_gmt":"2026-03-29T09:12:54","slug":"komprometacziya-pypi-paketa-telnyx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/komprometacziya-pypi-paketa-telnyx","title":{"rendered":"Kompromettering av PyPI-paketet Telnyx","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Utvecklarna av VoIP-plattformen Telnyx har varnat sina anv\u00e4ndare f\u00f6r att paketet telnyx i PyPI-repositoriet, som har 756 000 nedladdningar per m\u00e5nad och erbjuder SDK f\u00f6r att anv\u00e4nda Telnyx API fr\u00e5n Python-program, har blivit komprometterat. Den 27 mars kunde angripare publicera tv\u00e5 skadliga versioner, telnyx 4.87.1 och 4.87.2, efter att ha f\u00e5tt tillg\u00e5ng till PyPI genom kapitulation av f\u00f6ljares inloggningsuppgifter. De skadliga versionerna spreds mellan 6:51 och 13:13 (MSK), och blockerades d\u00e4refter av PyPI-administrationen. Infrastruktur, API, r\u00f6sttj\u00e4nster och plattformen Telnyx p\u00e5verkades inte. <\/p>\n

Komprometteringen skedde som en del av en mer omfattande supply chain-attack av TeamPCP, d\u00e4r nyligen Python-paketen LiteLLM och Trivy blev komprometterade, samt att skadlig kod integrerades i OpenVSX-till\u00e4gget Checkmarx och en skadlig mask blev inb\u00e4ddad i 68 paket i NPM-repositoriet. RSA-nyckeln som anv\u00e4ndes f\u00f6r att kryptera de skickade data matchade nycklar som anv\u00e4nts i andra attacker av gruppen TeamPCP. <\/p>\n

I de versioner som skapades av angriparna var skadlig kod inb\u00e4ddad, som integrerades i filen _client.py<\/code> och aktiverades vid import av modulen. Efter aktivering servrar<\/a> angriparna ner ljudfilen ringtone.wav f\u00f6r Unix-liknande system och hangup.wav f\u00f6r Windows. Dessa filer kunde framg\u00e5ngsrikt spela upp ljud men inneh\u00f6ll inb\u00e4ddade skadliga hanterare via steganografi. <\/p>\n

P\u00e5 Windows-plattformen sparades den skadliga hanteraren i systemet som %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\msbuild.exe<\/code> och startades vid varje inloggning. I macOS och Linux genomf\u00f6rdes s\u00f6kningar och s\u00e4ndningar av SSH-nycklar, autentiseringsuppgifter, inneh\u00e5ll i milj\u00f6variabler, API-\u00e5tkomsttoken, anslutningsparametrar till molntj\u00e4nster som AWS, GCP, Azure och K8s, nycklar till kryptovaluta pl\u00e5nb\u00f6cker, databaser och s\u00e5 vidare. De uppt\u00e4ckta uppgifterna krypterades med hj\u00e4lp av algoritmerna AES-256-CBC + RSA-4096 och skickades med en HTTP POST-beg\u00e4ran till en extern v\u00e4rd.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 VoIP-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Telnyx \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 telnyx \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 PyPI, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 756 \u0442\u044b\u0441\u044f\u0447 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043c\u0435\u0441\u044f\u0446 \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e SDK \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a API Telnyx \u0438\u0437 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Python. 27 \u043c\u0430\u0440\u0442\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u0434\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 telnyx 4.87.1 \u0438 4.87.2, \u043f\u043e\u043b\u0443\u0447\u0438\u0432 \u0434\u043e\u0441\u0442\u0443\u043f \u043a PyPI \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0438\u0441\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-166627","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kompromettering av PyPI-paketet Telnyx | ProHoster","description":"Utvecklarna av VoIP-plattformen Telnyx har varnat sina anv\u00e4ndare f\u00f6r att paketet telnyx i PyPI-repositoriet, som har 756 000 nedladdningar per m\u00e5nad och erbjuder SDK f\u00f6r att anv\u00e4nda Telnyx API fr\u00e5n program.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/komprometacziya-pypi-paketa-telnyx","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f PyPI-\u043f\u0430\u043a\u0435\u0442\u0430 Telnyx | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 VoIP-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Telnyx \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 telnyx \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 PyPI, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e 756 \u0442\u044b\u0441\u044f\u0447 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043c\u0435\u0441\u044f\u0446 \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e SDK \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a API Telnyx \u0438\u0437 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/komprometacziya-pypi-paketa-telnyx","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-29T09:12:54+00:00","article:modified_time":"2026-03-29T09:12:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/166627","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=166627"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/166627\/revisions"}],"predecessor-version":[{"id":168112,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/166627\/revisions\/168112"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=166627"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=166627"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=166627"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}