Microsoft Warns: MistralAI PyPI Package Compromised with Malware

Mistral’s official Python client on PyPI has been pulled into the ongoing wave of AI supply‑chain attacks, with Microsoft warning that version 2.4.6 of the mistralai package was backdoored to silently deploy a credential‑stealing payload on Linux systems.

The logic is designed to execute automatically whenever the package is imported, meaning developers simply using the library in code can unwittingly trigger the infection chain.

The injected function checks whether the host is running Linux, then sets an environment flag (MISTRAL_INIT) and attempts to fetch a secondary payload from hxxps://83[.]142[.]209[.]194/transformers.pyz, saving it as /tmp/transformers.pyz before execution.

The filename transformers.pyz appears intentionally chosen to mimic Hugging Face’s popular Transformers ecosystem, helping the malware blend in on machine learning and developer workstations where such names look routine.

According to Microsoft’s threat intelligence team, attackers compromised the mistralai PyPI package and injected malicious code into mistralai/client/__init__.py in version 2.4.6.

Once executed, the main payload functions as a credential stealer, targeting secrets and access tokens present on the compromised machine.

Microsoft notes that this kind of credential theft in AI and DevOps environments can expose access to cloud platforms, model repositories, and internal services, significantly amplifying the impact of a single compromised host.

The malware also embeds country‑aware logic that tailors its behavior based on environment and locale.

It explicitly avoids execution on Russian‑language environments, while implementing a geofenced destructive branch that activates when indicators suggest the system is in Israel or Iran.

In those cases, there is a 1‑in‑6 probability that the malware will run a destructive rm -rf / command, effectively attempting to wipe the filesystem and cause maximum disruption rather than focusing solely on data theft.

MistralAI PyPI Package

In addition to dropping /tmp/transformers.pyz, the attackers attempt to establish persistence and maintain operational visibility on infected Linux machines.

Organizations investigating potential compromise should look for the presence of pgmonitor[.]py and the pgsql-monitor.service systemd unit, which Microsoft highlights as part of the attacker’s tooling.

This pattern mirrors other recent PyPI supply‑chain incidents where threat actors inject multi‑stage payloads into widely used AI and developer packages to harvest credentials and then pivot deeper into cloud or Kubernetes environments.

By abusing trusted distribution channels like PyPI and disguising payloads as ML‑related components, attackers significantly increase their chances of landing in sensitive infrastructure.

Microsoft recommends that any environment which may have installed or imported mistralai v2.4.6 treat affected systems as potentially compromised and respond accordingly.

Security teams should prioritize isolating Linux hosts where the backdoored package was present, especially CI/CD runners, ML training nodes, and shared development bastions.

Network and security controls should be updated to block outbound traffic to 83[.]142[.]209[.]194 and monitor historical logs for any prior connections to that IP, as this may indicate earlier compromise.

Defenders should also proactively hunt for the presence of /tmp/transformers.pyz, pgmonitor[.]py, and the pgsql-monitor.service unit as concrete indicators of malicious activity tied to this campaign.

Given the credential‑stealing focus of the payload, organizations need to assume that secrets accessible from compromised hosts may already be exposed.

As part of incident response, rotate all potentially affected credentials API keys, cloud tokens, database passwords, SSH keys, and CI/CD secrets and strengthen controls around identity, isolation, and least privilege to limit blast radius in future supply‑chain attacks.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.