Mistral AI mistralai malicious dropper in PyPI package

Executive brief

The mistralai Python package version 2.4.6 was found to contain malicious code that automatically executes when the library is imported on Linux systems. This malicious code attempts to download and run an external file, which could lead to full system compromise, unauthorized data access, or credential theft. The legitimate developers did not release this version, and the PyPI project has been quarantined to prevent further infections.

Technical details

A malicious version of the mistralai package (v2.4.6) was uploaded to PyPI, containing a dropper function in src/mistralai/client/__init__.py. When the package is imported on a Linux platform, it uses curl to download a second-stage payload (transformers.pyz) from a remote IP address (83.142.209.194) to /tmp and executes it as a detached background process. The attack bypasses standard release workflows and utilizes module-load time execution to compromise the host environment. Users are advised to revert to version 2.4.5 and rotate any credentials accessible to the affected environment.

Affected products

• Mistral AI mistralai 2.4.6

Timeline

• 2026-05-12: disclosed: Malicious version 2.4.6 uploaded to PyPI and reported by community.
• 2026-05-18: advisory: GitHub Advisory GHSA-wx9m-wx4f-4cmg published.

References

• https://api.github.com/users/nullcharb
• https://github.com/nullcharb
• https://api.github.com/users/nullcharb/gists%7B/gist_id%7D
• https://api.github.com/users/nullcharb/repos
• https://avatars.githubusercontent.com/u/58240340?v=4
• https://api.github.com/users/nullcharb/events%7B/privacy%7D