Skip to content

Update Mini Shai-Hulud advisory status #494

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aetaix merged 1 commit into from
May 15, 2026
Merged

Update Mini Shai-Hulud advisory status #494

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions src/app/(docs)/(developers)/resources/security-advisories/page.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,14 +13,14 @@ This page lists security advisories that may affect Mistral SDKs, packages, or d

<SectionTab as="h2" sectionId="tanstack-supply-chain-attack">Mini Shai-Hulud supply chain attack affecting Mistral AI SDK packages</SectionTab>

**Reference:** MAI-2026-002
**Status:** Mitigated
**Published:** May 12, 2026
**Reference:** MAI-2026-002
**Status:** Investigation closed
**Published:** May 12, 2026
**Impact:** Potential risk to systems that installed affected packages

Mistral was impacted by a supply chain attack caused by the compromission of [TanStack, a third-party software](https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack). An automated worm associated with the attack led to **compromised NPM and PyPI SDKs versions being published**.

An affected developer device was involved. Forensics investigation showed that Mistral infrastructure was not compromised.
Investigation indicates that an affected developer device was involved, with no impact on Mistral global infrastructure.

:::info
The compromised npm packages were uploaded on May 11, 2026 at 22\:45 UTC and removed on May 12, 2026 at 01\:53 UTC. The compromised PyPI release was uploaded on May 12, 2026 at 00\:05 UTC and has been removed on May 12, 2026 at 03\:05 UTC. **Previous versions are not affected by this advisory.**
Expand Down Expand Up @@ -122,6 +122,7 @@ Look for any of the following files

<SectionTab as="h2" sectionId="changelog">Changelog</SectionTab>

- 14/05/2026: Investigation closed
- 14/05/2026 - 09\:55 UTC\: Update advisory with latest information.
- 13/05/2026 - 09\:00 UTC\: Incident is mitigated.
- 12/05/2026 - 14\:11 UTC\: Updated the severity of compromised NPM packages following our internal findings