Malicious code in mrmustard (PyPI)

Overview

---

-= Per source details. Do not edit below this line.=-

Source: kam193 (c98fd85267fd094cfb6b9a6e6e4d63bb5935298ad328ad5e4dedf3972e43d8f9)

Versions 0.7.4 were compromised.

Compromised release has embedded code that during import exfiltrates sensitive data (selected environmental variables, credentials to AWS, SSH keys etc.) and ensures persistence via multiple ways: a cron entry, a malicious PTH file, and a shell configuration file. Persistence is diguished as "tensorflow hardware compatibility check" using file placed under ~/.cache/.tf_cache/hw_probe.pyc. The malicious version was uploaded after exfiltrating the PyPI token from the CI environment, likely after compromising the maintainer's Github account.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-compr-hw-probe

Reasons (based on the campaign):

• exfiltration-env-variables

• exfiltration-ssh-keys

• The package contains code to detect if it is running in a sandbox environment.

• exfiltration-credentials

• persistence

• compromised-package

• abuses-pth

Affected packages

• mrmustard

Remediation

Refer to the advisory for the patched release.