Backdoored Telnyx PyPI package pushes malware hidden in WAV audio

TeamPCP hackers compromised the Telnyx package on the Python Package Index today, uploading malicious versions that deliver credential-stealing malware hidden inside a WAV file.

BleepingComputer
@ai6yr Apparently my 1990 decision to never learn another programming language is paying off.

@ai6yr it's pretty tragic. The altruistic and well intentioned built out digital ecosystems that by their very structure became vulnerable to those less well intentioned.

And now broadly we have the structures without the trust.

@buckfiftyseven @ai6yr

The primary mistake in tcp/IP is Vint made no provision for where a packet came from, only where it went, so fraud was inevitable (in hindsight) but more fundamental, digital memory can have so provenance. We can trace the cloth on the shroud of Turin but can say nothing at all about the age, origin or history of any given bit-value. Best we can do is only hearsay 😅

@ai6yr

VM all the untrusted code.

Maybe like Qubes
https://doc.qubes-os.org/en/latest/introduction/intro.html

Introduction

What is Qubes OS?: Qubes OS is a free and open-source, security-oriented operating system for single-user desktop computing. Qubes OS leverages Xen-based virtualization to allow for the creation an...

Qubes OS

@ai6yr I was primarily a mid to backend dev...still visibly remember seeing a front end JS project with 1000s of warnings from all the 3rd party packages.

Same feeling I had spending a night in my cousin's NYC apt in the 80s, turning on the kitchen light to get a snack and watching every surface *move*

@pixelpusher220 LOL ewwww on the kitchen light