PyPI quantum library mrmustard supply-chain attack: 0.7.4 ships a credential-stealing trojan

Attackers hijacked a Xanadu mrmustard maintainer GitHub account and published a malicious 0.7.4 on PyPI. On import it steals SSH keys, AWS credentials, and Kubernetes configs, then persists via cron, shell rc hooks, and a .pth file.

Incident overview

On 23–24 July 2026, the quantum computing library mrmustard on the Python Package Index (PyPI) was hit by a serious supply-chain attack. Attackers compromised a project maintainer GitHub account and published a trojanized 0.7.4 to PyPI. The malicious release runs on import, steals SSH keys, AWS credentials, Kubernetes configs, and other secrets, then plants persistence via cron, shell startup files, and Python `.pth` files.

GitHub user Ilyas Makari first reported it in XanaduAI/MrMustard issue #656. SafeDep, OSV (Open Source Vulnerabilities), and Gridinsoft later confirmed it and tracked it as MAL-2026-11049.

Technical details

Attack path

• Account compromise: attackers gained control of the mrmustard maintainer GitHub account
• Malicious publish: the compromised account published 0.7.4 directly to PyPI; no matching tag, release, or commit exists in the GitHub repo
• Import-time execution: payload runs on `import mrmustard`; no extra function call required
• Credential theft: SSH keys, AWS access keys, Kubernetes config files, SLURM job data, GPU inventory
• Persistence: cron jobs, shell rc hooks, and .pth files for long-term residency
• Exfiltration: collected data sent to attacker-controlled servers

Persistence analysis

Per SafeDep, the payload plants these paths:

| Path/file | Role | | --- | --- | | `~/.cache/.tf_cache/hw_probe.pyc` | compiled persistence stealer | | `~/.cache/.tf_cache/` | working dir for .lock_* and .ts_* state files | | `mmcompat.pth` | in site-packages; auto-loaded on Python startup | | cron (every 15 min) | `*/15 * * * * /usr/bin/env python3 .../hw_probe.pyc` | | shell rc hooks | inserts a tensorflow hardware compatibility check marked block into `.bashrc`/`.zshrc` |

Target environment

Payload is tuned for research and HPC:

• Collects SLURM job-scheduler data
• Enumerates GPU inventory and CUDA versions
• Steals cloud credentials (AWS, Azure, GCP)
• Steals SSH keys for lateral movement

On shared HPC login nodes, `mmcompat.pth` in a shared site-packages directory means any user who starts Python triggers the malware; blast radius exceeds a single user.

Impact

mrmustard is Xanadu's differentiable quantum-optics simulator, widely used in quantum computing research and photonic circuit simulation. Impact includes:

• Cloud infrastructure takeover: stolen AWS/Azure access keys can read/write cloud storage and change service config
• Lateral movement: leaked SSH keys allow passwordless login to other developer and researcher hosts
• Kubernetes cluster compromise: leaked K8s configs can put the whole container cluster under attacker control
• HPC resource abuse: stolen credentials may be used to hijack HPC resources for cryptocurrency mining
• Academic research data leak: sensitive quantum-computing data and IP at risk

Remediation

Emergency response (if 0.7.4 was installed)

SafeDep: uninstalling mrmustard is not enough. If any machine imported mrmustard@0.7.4 or has the persistence files above, clean as follows:

• Rotate credentials immediately: on a clean host, revoke or replace all exposed SSH keys, AWS access keys, Azure PAT, and Kubernetes credentials first
• Remove directory: `rm -rf ~/.cache/.tf_cache/`
• Delete `mmcompat.pth` from all site-packages directories
• Inspect and clean cron: `crontab -l`; remove entries pointing at `hw_probe.pyc`
• Inspect shell configs (`~/.bashrc`, `~/.zshrc`); remove the # tensorflow hardware compatibility check marked block
• Review CloudTrail and Kubernetes audit logs for anomalous credential use after 23 July 2026

Preventive measures

• Cross-check PyPI package versions against GitHub release tags and commits
• Scan packages before install with tools such as SafeDep Package Manager Guard (pmg)
• Enable SCA and dependency signature verification in CI/CD
• Rotate publishing credentials such as PyPI_TOKEN and CODECOV_TOKEN on a schedule
• Network-isolate GitHub Actions self-hosted runners and apply least privilege

Sources

• SafeDep: mrmustard PyPI malicious package analysis
• Gridinsoft: mrmustard 0.7.4 malware analysis and cleanup guide
• GitHub Issue #656: malicious 0.7.4 report
• OSV: MAL-2026-11049 malicious package record