MistralAI PyPI Package v2.4.6 Backdoored With Credential Stealer
MistralAI PyPI Package v2.4.6 Backdoored With Credential Stealer is a critical-severity supply chain compromise issue in mistralai, a package. Affected: ==2.4.6.
Is mistralai running on your developers' machines? Anomity inventories the AI agents, MCP servers, extensions and skills on every developer device, so you can see what this advisory touches. Detect this across your developers' devices with Anomity →
Key facts
- ID
mistralai-pypi-package-v2-4-6-backdoored-with-credential-stealer- Severity
- critical
- Attack type
- Supply chain compromise, Credential theft
- Component
- mistralai · package
- Package
mistralaipypi- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
The mistralai PyPI package v2.4.6 was published May 12 at 00:05 UTC containing injected malicious code that runs on import and spawns a background process to harvest credentials from ~/.aws, ~/.config/gcloud, ~/.ssh, browser cookie stores, and AI tool config directories. Microsoft removed the package within 3 hours, but the window was sufficient for an estimated 8,500 installs across Mistral SDK users, including agentic workflows that pin to "latest."
Affected versions
| Affected | Fixed in |
|---|---|
==2.4.6 | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run mistralai ==2.4.6.
How do I fix it?
Uninstall mistralai 2.4.6 and reinstall 2.4.7+. Rotate Mistral, AWS, GCP, and SSH credentials on any host that installed v2.4.6 between May 12 00:05–03:05 UTC. Block PyPI auto-upgrade in CI without lockfile pinning. Scan for outbound traffic to known stealer C2 endpoints.