Mistral AI: TeamPCP Source Code Theft and Extortion

"French AI lab Mistral AI is the named victim of a source code theft and extortion attempt by the supply chain crew tracked as TeamPCP (also tracked as UNC6780). According to Lavoixdefrance.fr, a poster using the TeamPCP…"

French AI lab Mistral AI is the named victim of a source code theft and extortion attempt by the supply chain crew tracked as TeamPCP (also tracked as UNC6780). According to Lavoixdefrance.fr, a poster using the TeamPCP handle advertised the haul on the Breached cybercrime forum on 13 May 2026, offering roughly 5 GB of internal code covering 450 repositories for $25,000, with a threat to publish it free if no buyer emerged. Both Lavoixdefrance.fr and Postpoliolitaff report that Mistral confirmed an incident, the former citing a public incident report referenced as MAI-2026-002, and both report that Mistral limited the scope: no critical infrastructure compromised, hosted services, user data and research environments reported unaffected. The intrusion did not start at Mistral. It started at TanStack, an open source JavaScript library, and reached Mistral through trojanized npm and PyPI packages published in Mistral's own name.

What Happened

The chain begins on 11 May 2026, when TanStack maintainers confirmed that 42 @tanstack packages had been hijacked and republished with a malicious payload, including @tanstack/react-router, which pulls more than 12 million downloads a week (Safeguard.sh). That was the second wave of the self propagating "Mini Shai-Hulud" npm worm. By the end of that day the worm had spread to 373 malicious versions across 169 npm packages and several PyPI projects tied to Mistral AI, OpenSearch and Guardrails AI, harvesting AWS, GitHub, npm, Vault and Kubernetes credentials from every machine that installed a poisoned version.

Lavoixdefrance.fr puts the Mistral package exposure window at roughly three hours, from 11 May 22:45 UTC to 12 May 01:53 UTC, and states that booby trapped versions of Mistral's npm and PyPI packages went out without the company being notified. The extortion listing followed on 13 May.

Palo Alto Unit 42, the highest tier source in this set, independently confirms the campaign scaffolding but not the Mistral theft itself. Unit 42 attributes two May 2026 Mini Shai-Hulud waves to TeamPCP, notes one used a credential free initial access technique and another produced the highest single hour package count of any Shai-Hulud worm to date, and warns that copycat activity has made future attribution to TeamPCP harder. Readers should hold that distinction: the worm and the actor are corroborated at vendor level, while the specific Mistral repository theft rests on the company's own reported statement plus lower tier press.

What Was Taken

Accounts converge on volume and price and differ on how the contents are described.

Volume: Postpoliolitaff says "nearly 5 gigabytes"; Lavoixdefrance.fr says "environ 5 Go". Call it approximately 5 GB, claimed by the seller and not independently verified.
Scope: Lavoixdefrance.fr is the only source giving a repository count, 450 internal repositories offered for sale. Postpoliolitaff does not give a count and instead describes the material as internal repositories and source code covering training, fine tuning and future project experiments.
Price: $25,000 in both accounts, with a leak threat attached if no buyer is found. Postpoliolitaff adds that the seller signalled willingness to negotiate.
What Mistral disputes: Postpoliolitaff reports Mistral's position that the compromised data was not part of its core code repositories and that hosted services, user data and research environments remain secure. That is the company's characterisation, and it has not been independently tested in the sources here.

Separately, the FBI FLASH describes what TeamPCP takes across the campaign generally: "cloud access tokens, SSH keys, and Kubernetes secrets" extracted from victim environments at scale (SecurityAffairs, pkgwarden). For any organisation that pulled a poisoned Mistral or TanStack package during the exposure window, that credential class is the realistic loss, regardless of what happened to Mistral's own repositories.

Why It Matters

On 2 July 2026 the FBI published FLASH-20260702-01, coordinated with DHS and CISA and marked TLP:CLEAR, formally attributing to TeamPCP a set of compromises previously tracked as separate incidents: Trivy (Aqua Security), KICS (Checkmarx), LiteLLM, the Telnyx Python SDK, and the Mini Shai-Hulud and Miasma worm waves. These are not fringe tools. Trivy is a container vulnerability scanner, KICS is infrastructure as code static analysis, and LiteLLM routes requests across AI model APIs. Poisoning them means hitting every organisation whose CI/CD pulls the update automatically.

Two escalations make this worse than a normal package incident. First, pkgwarden reports that the FLASH explicitly warns exfiltrated data and credentials are a persistent risk because "affiliated threat actors are likely to weaponize them long after the initial compromise." Rotation after the fact is not optional. Second, pkgwarden cites concurrent Sophos-sourced reporting that TeamPCP's partnership with the VECT ransomware group is converting supply chain footholds into ransomware deployments. A stolen CI token from May can become an encryption event later.

The AI sector is now a named target class. SecurityAffairs reports the Mini Shai-Hulud campaign also caught two OpenAI employees. Navanem lists TanStack, Mistral AI and Red Hat among TeamPCP's victims and describes a Miasma variant that embeds a 4.3 MB payload runner in a legitimate looking GitHub repository, firing on five confirmed trigger paths including Claude Code, Gemini CLI, Cursor, VS Code workspace tasks and npm test scripts, with zero CVEs assigned and forged SLSA provenance signatures that pass npm audit. Navanem reports GitHub disabled 73 repositories across four Microsoft organisations in 105 seconds on 5 June 2026 after a compromised contributor account pushed a malicious commit. Navanem also cites Sonatype counting more than 454,600 new malicious open source packages across npm, PyPI, Maven Central, NuGet and Hugging Face in 2025, a 75% year over year rise.

The Attack Technique

Per TanStack's own postmortem as reported by Safeguard.sh, the intrusion chained four steps rather than exploiting a single flaw:

Pwn Request. An attacker controlled pull request triggered a pull_request_target workflow, which runs with access to repository secrets even for untrusted fork contributions.
Actions cache poisoning across the fork to base trust boundary.
Runtime memory extraction. The attacker read the memory of the Runner.Worker process to lift a live GitHub Actions OIDC token before expiry.
Legitimate publish. That token was exchanged for short lived npm publish credentials scoped to TanStack's real release pipeline, so the trojanized packages shipped through legitimate CI and carried valid SLSA Build Level 3 provenance attestations.

Safeguard.sh reports StepSecurity traced the intrusion to a GitHub account named voicproducoes (account ID 269549300, created 19 March 2026), which forked the TanStack repository on 10 May 2026. Downstream, Mini Shai-Hulud propagates by stealing one maintainer's CI/CD credentials and using them to publish malicious versions of that maintainer's other packages, which is how Mistral's npm and PyPI artefacts entered the blast radius without Mistral itself being breached at the perimeter.

Attribution and Open Questions

Accounts differ on who TeamPCP ultimately is, and the evidence thins out fast.

A LinkedIn post by security practitioner Noyan Tendikov, citing Microsoft Threat Intelligence and Google Wiz reporting, claims the Mini Shai-Hulud payload in a compromised Mistral AI PyPI package carried a dead man's switch that activates if the GitHub token is revoked, skips systems with an RU locale, and executes rm -rf / with a 1 in 6 chance on systems in Israel or Iran. Treat this as a single lower tier claim: the underlying Microsoft and Wiz analyses are not in this source set, and the author's conclusion that TeamPCP works as contractors for or alongside Russian threat groups is explicitly framed as personal inference, not established attribution. The FBI FLASH, per both SecurityAffairs and pkgwarden, characterises TeamPCP as a criminal group and does not assert state affiliation. Unit 42's caution that copycat activity now muddies attribution cuts in the same direction.

Similarly unresolved: whether the stolen archive genuinely contains 450 repositories, whether any buyer materialised, and whether Mistral's "not core repositories" framing survives contact with the actual dataset if it ever leaks. None of the sources here report a leak or a payment.

What Organizations Should Do

Rotate anything a CI runner touched between 11 May and 12 May 2026, and more broadly across the March to July campaign window. Prioritise npm publish tokens, GitHub Actions OIDC and PATs, AWS keys, Vault tokens and Kubernetes secrets. The FBI's own warning is that this material gets weaponised long after the compromise.
Audit for pull_request_target in workflows. Any workflow running with secrets on untrusted fork input is the exact primitive that opened TanStack. Restrict it, or gate it behind maintainer approval and drop secret access from the fork path.
Stop treating provenance as proof. These packages carried valid SLSA Build Level 3 attestations because they were published through the real pipeline, and Navanem reports Miasma repositories pass npm audit with forged provenance signatures. Signature checks verify the pipeline, not the intent behind the commit.
Pin and lag dependencies. The Mistral exposure window was roughly three hours. Pinned versions with a deliberate quarantine delay before promoting new releases would have covered it entirely.
Pull the FBI FLASH-20260702-01 IOCs and hunt across build infrastructure for the named malware, network indicators and repository markers, with specific attention to Trivy, KICS, LiteLLM and the Telnyx Python SDK versions in your pipelines.
Treat cloned repositories as executable. Miasma triggers on AI coding agents and workspace tasks opening a project, with no user interaction beyond a routine clone. Open untrusted repositories in disposable, network restricted environments, and disable auto running workspace tasks and agent hooks by default.
Assume follow on ransomware. Given the reported TeamPCP and VECT relationship, a supply chain foothold should escalate to incident response and lateral movement hunting, not just dependency remediation.

Sources: TeamPCP Hackers Demand Ransom for Mistral AI Code: What We Know (2026) | The npm Threat Landscape: Attack Surface and Mitigations ... | FBI: TeamPCP Compromised Dev Tools to Steal Cloud Credentials | Mistral AI visée par une attaque supply chain : 5 Go de code volé,... | Link to full publication: Is TeamPCP a Russian-affiliated APT? How... | Miasma Worm Hijacks AI Coding Agents Navanem | FBI FLASH on TeamPCP supply-chain campaign and IOCs (July 2026) pk... | Mini Shai-Hulud Hits TanStack: npm Supply Chain Attack