Mistral AI said compromised versions of its npm and Python SDK packages were published in a supply-chain attack linked to the TanStack incident. The company said its affected Python release contained a malicious loader triggered by client-module imports on Linux, while broken code prevented the malicious payload from executing in its affected npm releases.
Mistral said its investigation pointed to an affected developer device and that it had no indication its infrastructure had been compromised.
TanStack’s security advisory described install-time malware capable of harvesting cloud credentials, GitHub and npm tokens, Kubernetes service-account tokens, Vault tokens and SSH private keys. The reported behavior put credentials accessible to dependency-installation processes on developer machines and continuous integration runners at risk.
Affected Mistral releases
Mistral said its compromised npm versions were available between May 11, 2026, at 22:45 UTC and May 12 at 01:53 UTC before being removed from the registry. The affected Mistral releases comprised three npm packages and one PyPI package:
| Ecosystem | Package | Affected versions |
|---|---|---|
| PyPI | mistralai |
2.4.6 |
| npm | @mistralai/mistralai |
2.2.2, 2.2.3, 2.2.4 |
| npm | @mistralai/mistralai-azure |
1.7.1, 1.7.2, 1.7.3 |
| npm | @mistralai/mistralai-gcp |
1.7.1, 1.7.2, 1.7.3 |
For the npm releases, Mistral said setup.mjs referenced tanstack_runner.js, while the included payload file was named router_init.js. That mismatch caused execution to fail before the payload ran, the company said. Mistral nevertheless recommended removing the affected versions.
Python loader triggered by client imports on Linux
Mistral’s Python SDK advisory said malicious code had been inserted into src/mistralai/client/__init__.py in version 2.4.6. Imports under mistralai.client.*, including those used in documented SDK examples, triggered the loader on Linux.
The advisory distinguished that trigger from a bare import mistralai, which did not activate the loader. It also said pip install, pip download and pip wheel did not invoke this dropper.
The advisory described code that downloaded transformers.pyz to /tmp/transformers.pyz, unless the file was already present, and attempted to launch it with the current Python interpreter as a detached background process. The loader returned without running on non-Linux platforms or if MISTRAL_INIT was already set. Otherwise, it set MISTRAL_INIT=1 to prevent the child process from triggering the loader again.
Mistral listed the temporary file, a Python process running it, the environment variable and outbound connections to 83[.]142[.]209[.]194 as indicators. Its Python advisory cautioned that finding the file alone did not confirm successful second-stage execution, while its absence did not rule out earlier execution if the file had been removed.
Wider campaign and credential exposure
Mistral linked the incident to the Mini Shai-Hulud campaign. Aikido’s malware team reported hundreds of malicious package-version entries across more than 160 npm package names, including packages in the @tanstack, @mistralai, @uipath and @squawk namespaces.
Affected TanStack packages included @tanstack/react-router, @tanstack/router-core and @tanstack/history. TanStack’s advisory said the malicious dependency executed during installation and included functionality to harvest credentials and republish infected packages using a victim’s publishing access.
Aikido’s analysis also described abuse of GitHub Actions trusted-publishing paths. The research team said provenance identifying an expected publishing workflow did not establish that the resulting package was free of malicious code.
Mistral’s advisories included lockfiles, package caches, private mirrors, build artifacts and container images in the exposure review because those copies could retain affected versions after registry removal. The Python advisory recommended treating Linux environments that performed the triggering imports as potentially compromised pending forensic review, rotating credentials reachable by the importing process and reviewing host and cloud audit logs.
TanStack similarly recommended rotating credentials accessible to installation processes that ran affected versions and reviewing cloud audit logs for activity from those hosts.
