Mistral AI's PyPI Package Hit by Supply Chain Attack

Microsoft is actively investigating a compromise of the Mistral AI PyPI package, specifically version 2.4.6. The attack appears connected to the broader Mini Shai-Hulud supply chain campaign targeting open-source software repositories.

Here's the wild part: the embedded malware was designed with geographic awareness. It reportedly refused to execute on systems running Russian-language configurations. However, under certain other geographic conditions, it could deploy a destructive payload.

Supply chain attacks on PyPI — Python's main package repository — have become an increasingly popular vector for threat actors. Poisoning a package tied to a high-profile AI company like Mistral amplifies the blast radius significantly, given how widely such dependencies get pulled into production environments.

Microsoft hasn't disclosed the full scope of impact yet. Developers using the affected package version should audit their environments immediately.