mrmustard PyPI hijack steals SSH, AWS and Kubernetes keys
An import-time stealer plants three persistence hooks and outlives uninstall — the latest in a PyPI wave that already hit litellm and MistralAI.
Copy markdown
What the stealer grabs
On import, mrmustard 0.7.4 runs a 258-line function that harvests ~/.ssh keys, AWS credentials and ~/.kube/config, plus SLURM queues and GPU inventory, then exfiltrates to metrics.femboy[.]energy. The tainted wheel hit PyPI on July 23 with no matching tag in XanaduAI's GitHub.
Uninstalling won't save you
It plants three persistence hooks — a 15-minute cron job, a .pth file in site-packages, and a shell rc hook — that survive pip uninstall. Cleanup means deleting ~/.cache/.tf_cache, stripping the .pth, and scrubbing cron plus your .bashrc/.zshrc.
It's a campaign, not a one-off
The same playbook already hit litellm and MistralAI's packages this year in the 'mini Shai-Hulud' wave spanning npm and PyPI, sweeping up GitHub, cloud and CI/CD credentials. If your AI stack pulls those, assume exposure and check your audit logs.
A clean repo is not a clean package
That mrmustard version exists on PyPI with no corresponding commit or release tag — the poisoned wheel went up via a compromised maintainer/CI token while the source repo stayed clean. 'Looks fine on GitHub' tells you nothing about what pip actually installs.
Harden your install path this weekend
Pin and hash-lock dependencies, verify a release has a matching git tag before installing, and run installs in a sandbox that can't see ~/.ssh or your cloud creds. Rotate any keys used on machines that touched 0.7.4 since July 23.