Malicious versions reported for this package
- MAL-2026-3608 — 2.4.6 · May 12, 2026
1 result · Feed
-
Critical 9.6
Malicious dropper in mistralai 2.4.6 PyPI package
The `mistralai` PyPI package version `2.4.6` contains a malicious dropper that executes on import on Linux. No `v2.4.6` tag, commit, or release workflow run exists in this repository, the legitimate latest version before the upload was `2.4.5`, and the upload…