Skip to content

Back to the catalog

Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials
stepsecurity.iowriteup

Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials

StepSecurity reconstructs how a malicious version of XanaduAI's mrmustard quantum-photonics library (0.7.4) reached PyPI: an attacker compromised a maintainer's GitHub account, used a throwaway workflow to exfiltrate the project's PyPI and Codecov tokens via webhook.site, then published a poisoned tarball directly (the malicious code never touched the git source tree). On import, the payload evades CI/container sandboxes, then steals SSH keys, AWS/Kubernetes credentials, and HPC/GPU environment data, XOR-obfuscates it, and beacons to metrics.femboy.energy before installing three persistence mechanisms (cron job, Python .pth hook, shell rc hook). The post includes full IOCs, detection guidance via Harden-Runner's Secret Exfiltration Attempt detection and Global Block Policy, and step-by-step recovery instructions.

TL;DR A compromised PyPI release of mrmustard 0.7.4 stole SSH/AWS/Kubernetes credentials via a sandbox-evading, XOR-obfuscated payload after the attacker exfiltrated the project's PyPI token through a hidden GitHub Actions workflow.
Open original ↗
Document

What it is

mrmustard 0.7.4 on PyPI is a malicious artifact — a credential stealer masquerading as a release of XanaduAI's quantum photonics library, published July 24, 2026. It was uploaded directly to PyPI using a stolen publishing token; the malware exists only in the tarball, not in the GitHub source, so source review would miss it. StepSecurity analyzed it under Harden-Runner.

Preconditions / Affected

Only 0.7.4 is malicious. Safe versions are 0.7.3 and earlier, and the 1.0.0a pre-releases. The payload runs on import mrmustard, but only fires on what it judges to be a real host — it returns silently inside CI or containers, so CI/build environments that installed it may not have detonated it (though the artifact is still poisoned).

How it works

The tarball is byte-identical to 0.7.3 except for a 258-line block prepended to the top-level mrmustard/__init__.py, disguised as _check_tf_compatibility() (343 lines vs. the clean file's handful). It runs on first import, spawns a background daemon thread, then deletes its own name from the module so mrmustard._check_tf_compatibility is gone even though it ran. It steals SSH private keys, AWS credentials, and Kubernetes configs, exfiltrates to the attacker's server, and installs three persistence mechanisms.

Evasion: it aborts if any of these env vars are set — CI, GITHUB_ACTIONS, GITLAB_CI, JENKINS_URL, TRAVIS, CIRCLECI, BUILDKITE, CODEBUILD_BUILD_ID — or if /.dockerenv or /run/.containerenv exists, and also inspects /proc/1/cgroup.

What to do

If you installed 0.7.4, treat the host as compromised. The page's remediation:

  • Rotate every credential the machine could reach — SSH keys, AWS credentials, Kubernetes configs.
  • Remove the package, the 15-minute cron job, the shell startup hook, and the .pth file in site-packages.
  • Block metrics.femboy.energy and femboy.energy.

Detection signals that confirm it's malicious (useful for triaging your own artifacts): no matching v0.7.4 git tag or GitHub release (last real tag v0.7.3 from March 2024, next is v1.0.0a1 from July 2025); payload absent from source tree; __init__.py bloated to 343 lines.

Caveats

The exfiltration domain in the summary (femboy.energy) and the specific subdomain to block (metrics.femboy.energy) both appear in the advisory — block both. The webhook.site collection URL was used only for the earlier token-theft stage; it is distinct from the runtime C2. Note the two malicious throwaway branches (pushed by account ziofil, July 23 2026) were deleted by the attacker, so they won't show in current branch listings.

Organisations named here

  • metrics.femboy.energy
  • XanaduAI
  • ziofil

Technologies named here

  • mrmustard
  • StepSecurity Harden-Runner
  • Global Block Policy
  • Secret Exfiltration Attempt detection
  • webhook.site
  • PyPI
  • Python
  • GitHub Actions
  • StepSecurity
  • AWS
  • Kubernetes
  • Harden-Runner

Techniques named here

  • Maintainer account takeover
  • CI reconnaissance via malicious workflow
  • CI secret exfiltration
  • Branch deletion to hide malicious workflow
  • Payload injection into published artifact only
  • Disguised malicious function name
  • Self-deleting function for stealth
  • Background daemon thread execution
  • Sandbox/CI/container evasion
  • Credential harvesting
  • System/environment reconnaissance
  • XOR obfuscation of C2 address and exfiltrated data
  • Exfiltration rate limiting to avoid detection
  • Multiple persistence mechanisms

Threat actors named here

  • Unnamed attacker

Related in Supply Chain