Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials

A compromised maintainer account published a malicious version of the mrmustard PyPI package (0.7.4) that, when imported, stealthily exfiltrates SSH, AWS, and Kubernetes credentials, installs multiple persistence mechanisms, and targets developer and research machines, making immediate remediation and credential rotation critical.