---
title: "GHSA-wx9m-wx4f-4cmg: Malicious dropper in mistralai 2.4.6 PyPI package"
url: https://erroneo.us/security/ghsa/GHSA-wx9m-wx4f-4cmg/
description: "GHSA-wx9m-wx4f-4cmg (critical, PyPI): Malicious dropper in mistralai 2.4.6 PyPI package. The mistralai PyPI package version 2.4.6 contains a malicious…"
type: advisory
section: "Security Digest"
date_published: 2026-05-18
date_modified: 2026-05-18
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-wx9m-wx4f-4cmg"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-wx9m-wx4f-4cmg: Malicious dropper in mistralai 2.4.6 PyPI package

## Affected packages

- PyPI `mistralai` = 2.4.6 → fixed: none listed

## Details

The mistralai PyPI package version 2.4.6 contains a malicious dropper that executes on import on Linux. No v2.4.6 tag, commit, or release workflow run exists in this repository, the legitimate latest version before the upload was 2.4.5, and the upload bypassed this repository's normal release pipeline (which uses PyPI Trusted Publishing). The mistralai PyPI project is currently quarantined. Affected - mistralai==2.4.6 on PyPI. Versions 2.4.5 and earlier are not known to be affected. What the malicious code does A function named runbackgroundtask was added to src/mistralai/client/init.py and called at module-load time. Reproduced from the public report in #523: On Linux only, the function: 1. Returns early if MISTRALINIT is already set in the environment. 2. Sets MISTRALINIT=1 so the spawned child does not re-trigger the dropper if it imports mistralai. 3. Downloads https://83.142.209.194/transformers.pyz to /tmp/transformers.pyz with curl -k -L -s (TLS verification disabled, 15 s timeout). Skips the download if the file is already present. 4. Spawns transformers.pyz with the current Python interpreter (sys.executable) as a detached process via Popen(..., startnewsession=True), with stdout and stderr discarded and any exception silently swallowed. On non-Linux platforms the function returns immediately and does nothing. The trigger is import mistralai, not package installation. pip install of a wheel does not execute package code; for an sdist it runs PEP 517 build hooks but those are in setup.py / pyproject.toml, not in init.py — so pip install, pip download, and pip wheel do not invoke this dropper. The contents of transformers.pyz are not in the package and were not analyzed in this advisory. The behavior of the second-stage payload on the host is therefore unknown. Recommendation Any Linux environment that imported mistralai==2.4.6 should be treated as potentially compromised pending forensic review. Rotate every credential reachable from the importing process and review host and cloud audit logs for activity from approximately 2026-05-12 00:05 UTC onward (per the timing reported in #523). Check whether you are affected Installed version: Dependency files and lockfiles: Dropped file on…

## Sources

- [GitHub Advisory GHSA-wx9m-wx4f-4cmg](https://github.com/advisories/GHSA-wx9m-wx4f-4cmg)
- [github.com](https://github.com/mistralai/client-python/security/advisories/GHSA-wx9m-wx4f-4cmg)
- [github.com](https://github.com/mistralai/client-python/issues/523)
- [safedep.io](https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral)
- [socket.dev](https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack)
- [stepsecurity.io](https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem)

---
Source page: https://erroneo.us/security/ghsa/GHSA-wx9m-wx4f-4cmg/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt