Malicious code in mrmustard (PyPI)

Source: amazon-inspector 535679eb30bfd0600dc07e44d2e649c88ecb6274364e2ba0b1ef2ccc05976727 On plain import mrmustard, the top-level init.py spawns a background thread that reads /.ssh/ private keys, /.aws/credentials, /.aws/config, /.kube/config, environment variables, pip freeze output, and...

Malicious Package

Overview mrmustard is a malicious package. This package contains malicious code, and its content was quarantined by the official package manager. Version 0.7.4 was published to PyPI using stolen maintainer credentials and contained an injected credential stealer. The malicious code ran upon impor...

MAL-2026-11049 Malicious code in mrmustard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535679eb30bfd0600dc07e44d2e649c88ecb6274364e2ba0b1ef2ccc05976727 On plain import mrmustard, the top-level init.py spawns a background thread that reads /.ssh/ private keys, /.aws/credentials, /.aws/config,...