{"action":"No fix published. Pin and monitor.","affected":[],"component":"mistralai","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-wx9m-wx4f-4cmg","id":"tcs_01M5KG329G3QG9Z8P7VTE5AM02","modified_at":"2026-05-18T18:06:24.120188Z","published_at":"2026-05-18T17:55:27Z","references":["https://osv.dev/vulnerability/GHSA-wx9m-wx4f-4cmg","https://github.com/mistralai/client-python/security/advisories/GHSA-wx9m-wx4f-4cmg","https://github.com/mistralai/client-python/issues/523","https://github.com/mistralai/client-python","https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral","https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack","https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-wx9m-wx4f-4cmg","url":"https://osv.dev/vulnerability/GHSA-wx9m-wx4f-4cmg"}],"summary":"Malicious dropper in mistralai 2.4.6 PyPI package"}