TeamPCP executed a software supply chain campaign affecting multiple projects, including LiteLLM, and more recently two malicious versions of the Telnyx Python SDK (4.87.1 and 4.87.2) as part of the same campaign. Telnyx provides APIs and underlying infrastructure for telephony, messaging, and AI supported conversation workflows. This blog post focuses on the malicious file formats involved in the attack, starting with an overview of those formats and concluding with their reverse engineering.