something similar happened with telnyx in march: https://telnyx.com/resources/telnyx-python-sdk-supply-chain-security-notice-march-2026 the guidance there is good while we await vapi's own postmortem