Unknown threat actors published a poisoned release of mrmustard 0.7.4, the photonic quantum computing library maintained by Xanadu, that runs an information-stealer on every package import. The stealer harvests SSH private keys, AWS credentials, and Kubernetes configurations and exfiltrates them to an attacker-controlled server at metrics.femboy[.]energy, according to analysis from StepSecurity and SafeDep disclosed on August 3.
The compromise sits at the intersection of two sensitive targets: a high-profile open-source library in the emerging quantum-computing space and the research and high-performance computing environments where that library is installed. Because mrmustard runs on import, a researcher who simply updates a dependency chain executes the stealer without any visible sign of tampering.
How the Rogue mrmustard 0.7.4 Release Was Pushed
The attackers breached the primary maintainer’s GitHub account to push the rogue version, according to StepSecurity. Before the publication, they probed the project’s self-hosted CI runners and exfiltrated publishing secrets to a webhook[.]site URL. The flow points to a supply-chain operator that targeted the publisher’s infrastructure directly rather than submitting a malicious version through the normal contribution path, which would have been visible to maintainers and reviewers.
The Info-Stealer’s Harvest in Research and HPC Environments
Beyond the usual cloud secrets, the stealer collects SLURM job queues and GPU inventories. SafeDep said the credential theft targets research and HPC environments specifically, gathering the orchestration and hardware details that let an operator understand a cluster’s workload and schedule. Stolen SSH keys and cloud credentials grant lateral movement into research systems, while Kubernetes configuration files expose the orchestration layer that manages them. The combination means a single compromised import can hand over both the keys to a cluster and a map of what runs on it.
Why Quantum and HPC Environments Are High-Value Targets
Xanadu’s library reaches the research and high-performance computing teams building photonic quantum systems, which makes the package an unusually precise delivery point for credential theft. The SLURM and GPU inventory data adds a reconnaissance layer: an operator who knows a target’s job queues and hardware can time follow-on access around compute availability. High-performance research environments also tend to hold long-lived credentials, since batch jobs and multi-day simulations depend on SSH and cloud access that outlives a single session.
Persistence Mechanisms That Outlive Package Removal
SafeDep documented three separate persistence mechanisms that keep the stealer running long after the package is uninstalled. The persistence design matters because a researcher who removes mrmustard after seeing the disclosure would otherwise assume the exposure ended with the package. The uninstall does not terminate the running stealer or its access to previously collected credentials, so cleanup requires identifying and removing each persistence path rather than relying on package removal alone.
Response From StepSecurity and SafeDep
StepSecurity and SafeDep published analysis identifying the command-and-control endpoint and the persistence mechanisms. Researchers who installed the affected version are advised to assume compromise and rotate credentials, and the analysis provides the indicators needed to check for the stealer on a given machine. The disclosure leaves open the question of how long the poisoned release was available and how many research environments pulled it during that window.
The incident is the latest sign that attackers are moving from stealing credentials through network intrusion to stealing them at the package-install layer, where the victim’s own trust in a legitimate library does the work. The breach of a maintainer account is itself a structural warning: the credentials used to publish releases are an attack surface, and a self-hosted CI environment that holds publishing secrets can become the entry point for poisoning an entire downstream ecosystem. For the quantum and HPC communities that depend on a small number of core libraries, the mrmustard case makes the point that the supply chain is only as strong as the least-protected account with publish rights.
