Microsoft Warns Of Compromised mistralai PyPI Package

Microsoft is investigating a supply-chain compromise of the Mistralai PyPI package (v2.4.6) in which attackers injected malicious code into the package initialization so it executes on import. On Linux hosts the dropper retrieves a second-stage payload from 83.142.209.194, installs /tmp/transformers.pyz (masquerading as Hugging Face Transformers), and harvests credentials and tokens; persistence artifacts include pgmonitor.py and pgsql-monitor.service. Organizations are advised to isolate affected hosts, block the IP, search file systems for the payload, hunt for persistence, and rotate exposed credentials.