github_repo
XanaduAI/MrMustard
discovered 2026-07-24
Legitimate upstream repo. Maintainer account 'ziofil' (Filippo Miatto, top contributor, 645 commits) compromised. Malicious commits 2ebfe28 (self-hosted-runner recon workflow running whoami) and 80aba72 (CI token exfil). Branches ci/mrmustard-check and nwmlqsxgnc deleted; commits reachable by SHA. No v0.7.4 tag/release exists.
