mrmustard 0.7.4 PyPI Package Compromised: Credential Stealer Alert
An early warning indicates that the mrmustard 0.7.4 package on PyPI appears to have been compromised, acting as a credential stealer upon import. Users of this package are advised to take immediate action.
What happened
On July 24, 2026, it was reported that mrmustard 0.7.4, a version of XanaduAI's open source quantum photonics library, was found on PyPI with credential-stealing malware. The release did not originate from the project's maintainers. Instead, an attacker reportedly took over a maintainer's GitHub account, used the project's CI to steal its publishing token, and uploaded a poisoned 0.7.4 version directly to PyPI. The malicious code was injected into the published artifact only, meaning the GitHub source appeared normal.
Upon import, the compromised mrmustard package is said to collect SSH private keys, AWS credentials, and Kubernetes configurations, exfiltrating them to a server controlled by the attacker. It also installs three persistence mechanisms to ensure it continues running even after the package is removed.
If you have installed mrmustard 0.7.4, it is recommended to treat the host as compromised. Rotate all potentially affected credentials, including SSH keys, AWS credentials, and Kubernetes configs. Remove the package, associated cron jobs, shell startup hooks, and .pth files in site-packages. Additionally, block the domain metrics.femboy.energy to prevent further communication with the attacker's server. For full analysis, indicators of compromise (IOCs), and detailed response steps, consult the primary sources.
How 0Day mitigates this
mrmustard is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.