Security Digest · Critical advisory (no CVE assigned)
GHSA-wx9m-wx4f-4cmg: Malicious dropper in mistralai 2.4.6 PyPI package
The mistralai PyPI package version 2.4.6 contains a malicious dropper that executes on import on Linux.
CVSS 9.6 Critical GitHub-reviewed · critical
Should you act?
- Malicious code, not a bug. If any listed version was ever installed, assume the machine and every secret on it are compromised: remove it, rotate credentials, rebuild.
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
pip-audit (or: pip show <package>). - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| PyPI | mistralai | = 2.4.6 | none listed |
Details
The mistralai PyPI package version 2.4.6 contains a malicious dropper that executes on import on Linux. No v2.4.6 tag, commit, or release workflow run exists in this repository, the legitimate latest version before the upload was 2.4.5, and the upload bypassed this repository's normal release pipeline (which uses PyPI Trusted Publishing).
The mistralai PyPI project is currently quarantined.
Affected
- mistralai==2.4.6 on PyPI.
Versions 2.4.5 and earlier are not known to be affected.
What the malicious code does
A function named runbackgroundtask was added to src/mistralai/client/init.py and called at module-load time. Reproduced from the public report in #523:
On Linux only, the function:
CVSS: 9.6 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Sources and references
- GitHub Advisory GHSA-wx9m-wx4f-4cmg github.com
- github.com github.com
- github.com github.com
- safedep.io safedep.io
- socket.dev socket.dev
- stepsecurity.io stepsecurity.io