PyPI Supply Chain Attack: Detecting TeamPCP Malicious Telnyx Packages

---
title: Python Script Accessing Sensitive Credential Files
id: 8a4b2c1d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects Python processes accessing sensitive files like .env, .aws/credentials, or known_hosts, common behavior in supply chain credential theft payloads like TeamPCP.
references:
  - https://www.infosecurity-magazine.com/news/teampcp-targets-telnyx-pypi-package/
author: Security Arsenal
date: 2025/03/18
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_access
  product: windows
detection:
  selection:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
    TargetFilename|contains:
      - '.env'
      - '.aws\credentials'
      - '.azure\credentials'
      - 'known_hosts'
  condition: selection
falsepositives:
  - Legitimate developer tools reading config (rare during execution flow)
level: high
---
title: Suspicious Child Process of Pip Installer
id: 9b5c3d2e-6f7a-5b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects pip.exe spawning a shell (cmd.exe or powershell.exe), which may indicate a malicious setup script executing a payload during installation.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2025/03/18
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\pip.exe'
      - '\pip3.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate post-install scripts that configure the environment
level: medium
---
title: Linux Python Process Accessing .env Files
id: 0c6d4e3f-7a8b-6c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects Python interpreter on Linux accessing .env files, indicative of credential harvesting malware in supply chain attacks.
references:
  - https://www.infosecurity-magazine.com/news/teampcp-targets-telnyx-pypi-package/
author: Security Arsenal
date: 2025/03/18
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_access
  product: linux
detection:
  selection:
    exe|endswith:
      - '/python'
      - '/python3'
    name|endswith:
      - '.env'
      - '.aws/credentials'
  condition: selection
falsepositives:
  - Developer reading own config files manually
level: high

// Hunt for Python processes accessing sensitive credential files
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoOriginalFileName in~ ("python.exe", "python3.exe", "python")
| extend FileName = tostring(split(ProcessVersionInfoOriginalFileName, ".")[0])
| where ProcessCommandLine has ".env" 
   or ProcessCommandLine has ".aws" 
   or ProcessCommandLine has "credentials"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

-- Hunt for Python processes accessing sensitive credential paths
SELECT
  Process.Pid,
  Process.Name,
  Process.Cmdline,
  Process.Exe,
  Process.Username,
  Process.Ctime
FROM pslist()
WHERE Name =~ "python"
  AND (
    Cmdline =~ ".env"
    OR Cmdline =~ ".aws/credentials"
    OR Cmdline =~ ".kube/config"
    OR Cmdline =~ "known_hosts"
  )

#!/bin/bash
# Audit and Remediation for TeamPCP PyPI Supply Chain Attack
# Targeting Telnyx package impersonation

echo "[*] Starting audit for Telnyx package compromise..."

# Function to check package details
check_package() {
    pkg_name=$1
    echo "[+] Checking package: $pkg_name"
    pip show "$pkg_name"
}

# 1. Check if Telnyx is installed and list details
if pip show telnyx > /dev/null 2>&1; then
    echo "[!] Telnyx package is installed. Verifying integrity..."
    check_package telnyx
    
    echo "[!] Action: Verify the 'Home-page' or 'Author' field above matches official Telnyx sources."
    echo "[!] If suspicious, run: pip uninstall telnyx -y"
else
    echo "[info] Telnyx package not found in current environment."
fi

# 2. List all recently installed packages (last 24 hours modified)
echo "[*] Checking for packages modified/installed in the last 24 hours..."
find /usr/local/lib/python*/dist-packages /home/*/.local/lib/python*/site-packages -name "*.egg-info" -mtime -1 2>/dev/null

# 3. Purge pip cache to remove malicious wheels if downloaded
echo "[*] Clearing pip cache to remove potential malicious artifacts..."
pip cache purge

echo "[*] Audit complete. Please review the output manually."
echo "[*] Recommendation: Reinstall Telnyx using 'pip install telnyx --force-reinstall' only after verifying source."