Microsoft Exposes Malware in Mistral AI SDK

A silent malware infection in Mistral AI's official SDK has triggered alarms across the developer community. Microsoft Threat Intelligence confirmed on May 12, 2026 that hackers compromised PyPI packages used by thousands of AI developers. The attack represents a systemic threat—uninstalling affected packages fails to remove the malware due to persistent Claude Code hooks and VS Code task integrations.

The breach originated from a coordinated May 11 supply chain attack impacting over 170 npm and 2 PyPI packages. Hackers exploited GitHub Actions vulnerabilities and maintainer misconfigurations to distribute infected packages with valid signatures. TeamPCP, the suspected threat actor, specifically targeted developer credentials through these compromised dependencies.

Microsoft's investigation reveals the malware's sophistication—it bypasses conventional detection by mimicking legitimate updates. The incident underscores critical vulnerabilities in open-source AI infrastructure, where a single compromised package can cascade through entire development ecosystems.