Xanadu's photonic quantum computing Python library, mrmustard, was compromised with a poisoned version that ran an information stealer. The attack involved breaching the maintainer's GitHub account and exploiting CI runners to exfiltrate publishing secrets.