OPEN LINK ↗
// 1h agoSECURITY INCIDENT
Microsoft probes backdoored mistralai PyPI release
Microsoft is investigating a compromise of mistralai v2.4.6 on PyPI, the Python client SDK for Mistral AI. The reported malicious changes were injected into mistralai/client/__init__.py, execute automatically when the package is imported on Linux, and appear designed to fetch and run a second-stage payload while dropping persistence and host-artifact traces.
// ANALYSIS
Hot take: this is exactly the kind of package compromise that turns routine dependency updates into full environment compromise.
- –Import-time execution makes the blast radius immediate for any app that upgraded or reinstalled the package.
- –Treat Mistral API keys, cloud credentials, and CI secrets as potentially exposed if the package was installed in affected Linux environments.
- –Reported indicators include /tmp/transformers.pyz, pgmonitor.py, pgsql-monitor.service, and traffic to 83.142.209.194.
- –The incident matters less as a Mistral AI product story and more as a developer-supply-chain warning for anyone pulling PyPI SDKs into production.
// TAGS
pypisupply-chainmalwarecredential-stealermistral-aipythonlinuxopen-sourcesecuritysdk
DISCOVERED
1h ago
2026-05-12
PUBLISHED
2h ago
2026-05-12
RELEVANCE
9/ 10
AUTHOR
IntCyberDigest