The mrmustard 0.7.4 PyPI package was found to contain credential-stealing malware injected by an attacker who compromised a maintainer's GitHub account. The attacker used the project's own CI to exfiltrate the PyPI publishing token, then uploaded a poisoned package that runs on every import. The payload collects SSH private keys, AWS credentials, Kubernetes configs, and HPC environment details, sending them to an attacker-controlled C2 server. It also installs three persistence mechanisms (cron job, Python .pth file, shell startup hook) that survive package removal. The attack specifically targeted quantum computing and HPC researchers. Indicators of compromise, recovery steps, and detection methods using StepSecurity Harden-Runner are provided.
