Xanadu MrMustard PyPI release stole HPC and cloud credentials

A malicious release of mrmustard, the photonic quantum computing library published by Xanadu, appeared on PyPI on July 23, 2026. Anyone who ran import mrmustard from version 0.7.4 had their SSH private keys, AWS credentials, and Kubernetes configuration read off disk and sent to an attacker-controlled server.

MrMustard is a research library for simulating photonic quantum circuits, the kind of package that lives on university workstations and HPC login nodes rather than in web application pipelines. The payload was built for that audience. Alongside the usual cloud secrets it collected SLURM job queues and GPU inventories, which is a reasonable way to map a research cluster from a single infected laptop.

The mismatch between PyPI and GitHub gave the incident away. Version 0.7.4 exists on PyPI with no corresponding tag, release, or commit in the XanaduAI/MrMustard repository, whose tags stop at v0.7.3. StepSecurity and SafeDep, which both analyzed the release, described an attacker who took over a maintainer's GitHub account, used the project's own CI to obtain its publishing token, and then uploaded the poisoned artifact straight to the index, skipping the repository entirely.

Execution happened at import rather than at install, so the code ran the first time a researcher used the library rather than when pip finished. Three separate persistence mechanisms kept a stealer running after the package was uninstalled, which is the part that turns a bad afternoon into an incident response. Anyone who imported the affected version was told to treat the host as compromised and rotate every credential that had been present on it.