Between May 11 and 12, 2026, the worm tracked as Mini Shai-Hulud published more than 400 malicious versions of 170 packages across npm and PyPI, the first campaign to span both registries in a single run. The TanStack router ecosystem took 42 packages. UiPath took 65. OpenSearch, Guardrails AI and Mistral AI's SDK suite on both registries were hit. Endor Labs called it the fifth wave of the Shai-Hulud family in eight months. Days later the operators released their worm as open source.
What mistralai 2.4.6 did
The version was never released by Mistral. Code injected into src/mistralai/client/__init__.py ran on import on Linux hosts, downloaded transformers.pyz from a hardcoded address, 83.142.209.194, saved it to /tmp under a name chosen to blend into machine learning environments, and executed it as a detached process. Microsoft Threat Intelligence confirmed the main payload as a credential stealer targeting cloud credentials, CI tokens, GitHub tokens and API keys, with country-aware logic; researchers found a geofenced destructive branch with a one-in-six chance of running rm -rf /. The package was live for a few hours. Mistral's advisory MAI-2026-002 attributes the publish to an automated worm following the TanStack compromise.
The two payload hosts
| Variant | Second stage fetched from | What a name-based control sees |
|---|---|---|
| npm (TanStack, @mistralai/*, @uipath/*) | git-tanstack[.]com/transformers.pyz | A first-seen lookalike domain. Held by a build policy that has never resolved it. |
| PyPI (mistralai 2.4.6) | https://83.142.209.194/transformers.pyz | Nothing. No lookup occurred. This is the egress firewall's case. |
Wiz noted the npm payload contained a bug that rendered it non-functional in the @mistralai and @uipath packages. The PyPI payload worked.
What to do
- 01Search every Linux host and CI cache for mistralai==2.4.6 and for /tmp/transformers.pyz. Rotate every credential on a host that imported it.
- 02Adopt a dependency cooldown. A version published in the last 24 to 72 hours does not install in CI without a review. Both registries had the packages down within hours; a cooldown would have skipped the window entirely.
- 03Put build runners on a resolver policy that allows the registries and the repository host and holds first-seen names. Coding agents install packages without verification, which makes the runner the control point.
- 04Block outbound connections to raw IPs from build networks at the firewall, and alert on any that occur.
pip index versions mistralai 2>/dev/null | head -1
pip freeze | grep -i '^mistralai==2.4.6' && echo "COMPROMISED: rotate credentials on this host"
ls -la /tmp/transformers.pyz 2>/dev/null && echo "payload present"