Suggestions
Feross Aboukhadijeh
Founder & CEO of Socket, Open Source Developer
Feross Aboukhadijeh is the Founder and CEO of Socket, a company focused on enhancing security and privacy in software development, particularly concerning open-source software. He is based in the San Francisco Bay Area and has a strong background in technology and open-source contributions.
Background and Career
Feross graduated from Stanford University and has over a decade of experience in open-source software development. He is known for creating several widely used JavaScript packages and has previously worked at notable companies, including Intel, Facebook, and Quora. His early work includes developing PeerCDN, a pioneering peer-to-peer content delivery network.145
At Socket, Feross leads efforts to help developers and security teams manage and secure open-source dependencies, aiming to streamline the software supply chain while mitigating security risks. The platform is designed to assist organizations in auditing and managing their open-source software effectively.234
Contributions and Vision
Feross is passionate about improving the developer experience and addressing security challenges in software development. He emphasizes the importance of curiosity, persistence, and a love for technology as key traits for success in the tech industry. His vision for the future includes a more open technology landscape that prioritizes long-term impact over short-term gains.12
In addition to his role at Socket, Feross serves as a lecturer at Stanford, teaching courses on web security, further solidifying his commitment to education and the tech community.25
Highlights
🚨 TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
What happened: Versions 4.87.1 and 4.87.2 of the telnyx Python SDK on PyPI were compromised by TeamPCP with credential-stealing malware. PyPI has quarantined both versions. Users should pin to 4.87.0.
How it works: Three-stage attack chain. Malicious code injected into _client.py (the core HTTP client), so it fires at import telnyx – not via postinstall hooks, which are heavily monitored. Dual OS-specific paths: Windows gets a persistent binary dropped in the Startup folder disguised as msbuild.exe; Linux/macOS gets a one-shot fileless harvester that exfiltrates credentials and self-destructs.
Notable tradecraft:
-
Audio steganography for payload delivery – second-stage harvester hidden in WAV files downloaded from C2, extracted via base64 + XOR
-
Fileless execution on Linux – harvester runs via stdin pipe to a child Python process, never touches disk
-
Hybrid encryption on exfil – AES-256-CBC with RSA-4096 wrapped session keys using OAEP padding. Data is unrecoverable without the attacker’s private key
-
No new dependencies added – uses only stdlib modules and system openssl/curl
Operational details: The attacker shipped a bugfix release (4.87.2) solely to fix a case-sensitivity typo that broke the Windows path. This confirms sustained access to publishing credentials and an active testing pipeline. Neither malicious version has corresponding commits in the official GitHub repo.
C2: 83.142.209.203:8080, plain HTTP, telephony-themed filenames (ringtone.wav, hangup.wav).
Action items: Rotate all credentials from any environment that imported these versions. Block the C2 IP. Check Windows Startup folders. Purge from internal mirrors.
Very important article to read based on @SocketSecurity research.



