{
  "entry": {
    "kind": "vuln",
    "slug": "mistralai-pypi-package-v2-4-6-backdoored-with-credential-stealer",
    "name": "mistralai-pypi-package-v2-4-6-backdoored-with-credential-stealer",
    "vendor": "mistralai",
    "description": "The mistralai PyPI package v2.4.6 was published May 12 at 00:05 UTC containing injected malicious code that runs on import and spawns a background process to harvest credentials from ~/.aws, ~/.config/gcloud, ~/.ssh, browser cookie stores, and AI tool config directories. Microsoft removed the package within 3 hours, but the window was sufficient for an estimated 8,500 installs across Mistral SDK users, including agentic workflows that pin to \"latest.\"",
    "website": "https://cybersecuritynews.com/mistralai-pypi-package-compromised/amp/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "pypi",
      "packageName": "mistralai",
      "command": null
    },
    "configFiles": null,
    "category": "package",
    "updatedAt": "2026-05-12",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "mistralai-pypi-package-v2-4-6-backdoored-with-credential-stealer",
      "aliases": [
        "ti-023"
      ],
      "title": "MistralAI PyPI Package v2.4.6 Backdoored With Credential Stealer",
      "summary": "The mistralai PyPI package v2.4.6 was published May 12 at 00:05 UTC containing injected malicious code that runs on import and spawns a background process to harvest credentials from ~/.aws, ~/.config/gcloud, ~/.ssh, browser cookie stores, and AI tool config directories. Microsoft removed the package within 3 hours, but the window was sufficient for an estimated 8,500 installs across Mistral SDK users, including agentic workflows that pin to \"latest.\"",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Credential theft"
      ],
      "componentType": "package",
      "component": {
        "name": "mistralai",
        "vendor": null,
        "package": "mistralai",
        "ecosystem": "pypi",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "==2.4.6",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-05-12",
      "modifiedAt": "2026-05-12",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://cybersecuritynews.com/mistralai-pypi-package-compromised/amp/"
        }
      ],
      "mitigation": "Uninstall mistralai 2.4.6 and reinstall 2.4.7+. Rotate Mistral, AWS, GCP, and SSH credentials on any host that installed v2.4.6 between May 12 00:05–03:05 UTC. Block PyPI auto-upgrade in CI without lockfile pinning. Scan for outbound traffic to known stealer C2 endpoints.",
      "detectedByAnomity": false
    }
  }
}