{"data":{"id":"a7a92fe5-f337-49c0-bdb5-2ea88199731b","title":"GHSA-jgg6-4rpr-wfh7: Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp","summary":"Compromised versions of @mistralai/mistralai (2.2.2, 2.2.3, 2.2.4), @mistralai/mistralai-azure and @mistralai/mistralai-gcp (1.7.1, 1.7.2, 1.7.3) were published to npm between May 11 at 22:45 UTC and May 12 at 01:53 UTC as part of a supply chain attack linked to the TanStack incident. The source says an affected developer device was involved and that Mistral infrastructure shows no sign of compromise. The embedded dropper is broken: setup.mjs references tanstack_runner.js while the payload is named router_init.js, so the payload never runs.","solution":"Stop using the affected package versions immediately. Clean systems where one of these packages has been installed. Check lockfiles, build artifacts, container images, package caches and private mirrors for affected versions, and remove the packages even though the dropper is broken.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-jgg6-4rpr-wfh7","publishedAt":"2026-05-18T17:55:53.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"low","severity":"low","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["@mistralai/mistralai-gcp@= 1.7.3","@mistralai/mistralai-gcp@= 1.7.2","@mistralai/mistralai-azure@= 1.7.3","@mistralai/mistralai-azure@= 1.7.2","@mistralai/mistralai@= 2.2.4"],"affectedPackageNames":["@mistralai/mistralai-gcp","@mistralai/mistralai-azure","@mistralai/mistralai"],"affectedPackageRefs":["npm:@mistralai/mistralai","npm:@mistralai/mistralai-azure","npm:@mistralai/mistralai-gcp"],"affectedVendors":["Mistral"],"affectedVendorsRaw":["@mistralai/mistralai","@mistralai/mistralai-azure","@mistralai/mistralai-gcp"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-jgg6-4rpr-wfh7"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-05-18T17:55:53.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"]}}