Xanadu MrMustard PyPI release stole HPC and cloud credentials

A malicious release of mrmustard, the photonic quantum computing library published by Xanadu, appeared on PyPI on July 23, 2026. Anyone who ran import mrmustard from version 0.7.4 had their SSH private keys, AWS credentials, and Kubernetes configuration read off disk and sent to an attacker-controlled server.

MrMustard is a research library for simulating photonic quantum circuits, the kind of package that lives on university workstations and HPC login nodes rather than in web application pipelines. The payload was built for that audience. Alongside the usual cloud secrets it collected SLURM job queues and GPU inventories, which is a reasonable way to map a research cluster from a single infected laptop.

The mismatch between PyPI and GitHub gave the incident away. Version 0.7.4 exists on PyPI with no corresponding tag, release, or commit in the XanaduAI/MrMustard repository, whose tags stop at v0.7.3. StepSecurity and SafeDep, which both analyzed the release, traced the route in. Two commits were pushed on July 23 through the account of ziofil, the project's original author, both on throwaway branches since deleted. The first deleted seven legitimate workflow files and added one that ran whoami on the project's self-hosted runners, which is reconnaissance and nothing else. The second added a workflow that read PIPY_TOKEN and CODECOV_TOKEN out of Actions secrets, base64 encoded them, and curled them to a webhook.site collection URL. With the publishing token in hand the attacker uploaded the poisoned artifact straight to the index, skipping the repository entirely.

Execution happened at import rather than at install, so the code ran the first time a researcher used the library rather than when pip finished, and it sat out any run where CI variables or a container were detected. The collected data went to https://metrics.femboy.energy/v1/collect, a URL the payload kept XOR obfuscated under the key tf_compat_v2 rather than in plaintext. The payload then compiled a copy of itself to ~/.cache/.tf_cache/hw_probe.pyc and pointed three independent persistence hooks at it: a cron job every fifteen minutes, a line in ~/.bashrc or ~/.zshrc disguised as a # tensorflow hardware compatibility check, and an mmcompat.pth file in site-packages. The last of those is the worst of the three. Python executes .pth files on every interpreter start, so the stealer ran on any python invocation, survived pip uninstall mrmustard, and on a shared HPC login node ran for every user who started Python there. Anyone who imported the affected version was told to treat the host as compromised and rotate every credential that had been present on it.