Poisoned Pipeline / Incidents / AS67
mrmustard 0.7.4 PyPI credential stealer via stolen publish token
On 24 July 2026 XanaduAI’s quantum photonics library mrmustard 0.7.4
appeared on PyPI with no matching git tag. An attacker who took over
maintainer ziofil used throwaway GitHub Actions workflows to recon
self-hosted runners (whoami) then POST the repo’s PyPI and Codecov
tokens to webhook.site. With the token they uploaded 0.7.4; only the
tarball’s __init__.py carried a fake _check_tf_compatibility() that
on import stole SSH keys, AWS and Kubernetes configs, skipped CI, and
installed cron, a .pth hook, and a shell-rc persistence. First reported
by Ilyas Makari / Aikido (GitHub issue 656); StepSecurity detonated it.
Mapped techniques
- T0113 Compromised user account
- T0166 Trigger pipeline execution
- T0140 Harvest tokens from environment variables
- T0121 Compromised legitimate artifact
- T0184 Harvesting sensitive information from files
- T0172 Runtime backdoor
supply-chain stolen pypi token plus poisoned wheel
Maintainer GitHub account ziofil taken over.
Throwaway workflows on self-hosted runners then secret dump.
PyPI and Codecov secrets posted to webhook.site.
0.7.4 existed only on PyPI, not in git.
SSH keys, AWS credentials, kubeconfig on import.
Cron, site-packages .pth, and shell-rc persistence.