StepSecurity Details Credential-Stealing mrmustard 0.7.4 PyPI Release

Summary

StepSecurity says a malicious PyPI-only mrmustard 0.7.4 release stole CI publishing tokens and, on import, harvested credentials and installed three persistence mechanisms; sandbox testing observed the behavior.

Key points

StepSecurity reports that an attacker used workflows pushed through a maintainer account to exfiltrate PyPI and Codecov tokens, then uploaded malicious version 0.7.4 directly to PyPI.
The malicious code was added to the published package artifact, not the project source; the article says 0.7.4 had no matching GitHub release or tag.
On import, the payload sought SSH keys, AWS credentials, Kubernetes configuration, selected environment variables, and system details, then attempted to send collected data to metrics[.]femboy[.]energy.
The payload avoided running in detected CI and container environments, and installed a 15-minute cron job, a Python .pth startup hook, and a shell startup hook for persistence.
In StepSecurity's sandbox test, importing the package created the persistence mechanisms; Harden-Runner blocked the outbound connection to the reported command-and-control host.
The article advises affected users to rotate reachable credentials, remove the package and persistence artifacts, block the reported infrastructure, and review network logs and CI access.

Article Details

Attack Vectors: An attacker took over a mrmustard maintainer's GitHub account and pushed workflows that first ran reconnaissance on self-hosted runners, then read PyPI and Codecov tokens from GitHub Actions secrets and sent them to a webhook.site collection URL.
Using the stolen PyPI publishing token, the attacker uploaded a malicious mrmustard 0.7.4 artifact. The injected code was present in the PyPI tarball but not in the project source tree or a corresponding GitHub release.
On import, the payload checked for CI and container environments, then harvested SSH private keys, AWS credentials, Kubernetes configuration, selected environment variables, and system details before sending the data to its C2.
The payload installed persistence through a 15-minute cron job, a Python .pth startup file, and a shell startup hook in .bashrc or .zshrc.
Defensive Notes: Treat any host that installed mrmustard 0.7.4 as compromised; rotate all credentials it could access before cleanup.
Remove the malicious package, the cron job, the .pth file, the shell startup hook, and ~/.cache/.tf_cache. Reinstall only a known-good version such as 0.7.3 if needed.
Block metrics.femboy.energy and femboy.energy, and audit network logs for connections to those domains and the webhook.site URL.
For the XanaduAI project, rotate the PyPI and Codecov tokens, revoke the compromised maintainer account's tokens and sessions, and review self-hosted runner access.
Check dependency files for mrmustard 0.7.4 and inspect developer machines, CI runners, and research-cluster login nodes for the described persistence artifacts.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`femboy[.]energy`	Domain associated with the C2 and explicitly recommended for blocking by the article.
DOMAIN	`metrics[.]femboy[.]energy`	Attacker-controlled C2 domain contacted by the payload.
URL	`hxxps[:]//metrics[.]femboy[.]energy/v1/collect`	C2 collection URL used by the malicious package to exfiltrate stolen data.
URL	`hxxps[:]//webhook[.]site/710babde-6ace-47fe-83f4-9688e6548df9`	Specific webhook collection URL that the malicious CI workflow used to exfiltrate PyPI and Codecov tokens.