Malicious code in mrmustard (PyPI)

A compromised or impersonated version of the mrmustard package was distributed via PyPI. Upon import, the malicious init.py spawns a background thread that collects sensitive data including SSH private keys from ~/.ssh/, AWS credentials and config files, Kubernetes configuration, environment variables, pip freeze output, and host/GPU/SLURM identifiers.\n\nThe collected data is XOR-encoded with the key 'tf_compat_v2', base64-wrapped, and exfiltrated via HTTP POST to a runtime-reconstructed endpoint using a spoofed browser User-Agent. The code includes detection logic to avoid execution in CI/CD environments (GitHub Actions, GitLab CI, Jenkins, Travis, CircleCI, Buildkite, CodeBuild) and containerized environments (Docker, Kubernetes, LXC).\n\nThree persistence mechanisms are installed under the guise of a 'tensorflow hardware compatibility check': a compiled dropper written to ~/.cache/.tf_cache/hw_probe.pyc, a crontab entry executing every 15 minutes, an 'mmcompat.pth' file in site-packages for Python startup execution, and launcher lines appended to shell configuration files (~/.bashrc, ~/.zshrc, fish config). These mechanisms continue exfiltration even after the package is uninstalled.\n\nThe legitimate MrMustard package is maintained by Xanadu and does not contain this malicious code.