The TeamPCP hacker group is advertising nearly 450 Mistral AI internal code repositories for sale at $25,000, threatening to leak them publicly if no buyer is found within a week. The breach stems from the Mini Shai-Hulud software supply-chain attack, which compromised TanStack and Mistral AI packages via stolen CI/CD credentials. The attack spread to hundreds of projects on npm and PyPI registries. Mistral AI confirmed that some SDK packages were contaminated but states that core repositories, hosted services, managed user data, and research environments were not compromised. OpenAI also confirmed that two employees' systems were affected, with a limited subset of internal source code repositories accessed and a small set of credentials stolen.
