[BUG CLIENT]: Quarantined on PyPi, breaking deployments

[hankhank10]

Python -VV

N/A

Pip Freeze

N/A

Reproduction Steps

Try to pip install

Expected Behavior

Package installs

Additional Context

https://pypi.org/project/mistralai/

Suggested Solutions

No response

[evilgodfahim]

Affected here too. This is blocking my production pipeline entirely.

[Molozey]

+1. Cannot build image with pydantic-ai

[AlexFoxalt]

Running

poetry add "mistralai[gcp]"

Leads to:

Could not find a matching version of package mistralai

[george-orbioai]

Try this in pyproject.toml (if using uv)

[tool.uv.sources]
mistralai = { git = "https://github.com/mistralai/client-python.git", tag = "v1.12.4" }

or whatever version you want to use

[adam-fallon]

Important

Warning: DO NOT TRY TO POINT TO 2.4.6 IN THIS WAY - THE PACKAGE IS COMPROMISED

Does anyone get this failure?

I tried adding the dependency manually pointing at git with a specific tag

...
"mistralai @ git+https://github.com/mistralai/client-python.git@v1.12.4",
...

but I get this error - I take it that the README-PYPI.md is generated as part of the build process and that is why this fails?

  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... error
  error: subprocess-exited-with-error
  
  × Preparing metadata (pyproject.toml) did not run successfully.
  │ exit code: 1
  ╰─> [39 lines of output]
      Traceback (most recent call last):
        File "/private/var/folders/v7/w7h8mbj1131g_gryv3880mn80000gn/T/pip-build-env-kwlthjhr/overlay/lib/python3.13/site-packages/poetry/core/masonry/metadata.py", line 69, in from_package
          descriptions.append(readme.read_text(encoding="utf-8"))
                              ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
        File "/opt/homebrew/Cellar/python@3.13/3.13.13/Frameworks/Python.framework/Versions/3.13/lib/python3.13/pathlib/_local.py", line 546, in read_text
          return PathBase.read_text(self, encoding, errors, newline)
                 ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        File "/opt/homebrew/Cellar/python@3.13/3.13.13/Frameworks/Python.framework/Versions/3.13/lib/python3.13/pathlib/_abc.py", line 632, in read_text
          with self.open(mode='r', encoding=encoding, errors=errors, newline=newline) as f:
               ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        File "/opt/homebrew/Cellar/python@3.13/3.13.13/Frameworks/Python.framework/Versions/3.13/lib/python3.13/pathlib/_local.py", line 537, in open
          return io.open(self, mode, buffering, encoding, errors, newline)
                 ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
      FileNotFoundError: [Errno 2] No such file or directory: '/private/var/folders/v7/w7h8mbj1131g_gryv3880mn80000gn/T/pip-install-qd6dgmse/mistralai_9bd9fb408e3a4b30abfdbe72f936d2dd/README-PYPI.md'
      
      The above exception was the direct cause of the following exception:
      
      Traceback (most recent call last):
        File "/Users/user/code/android-fixes/.venv/lib/python3.13/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 389, in <module>
          main()
          ~~~~^^
        File "/Users/user/code/android-fixes/.venv/lib/python3.13/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 373, in main
          json_out["return_val"] = hook(**hook_input["kwargs"])
                                   ~~~~^^^^^^^^^^^^^^^^^^^^^^^^
        File "/Users/user/code/android-fixes/.venv/lib/python3.13/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 175, in prepare_metadata_for_build_wheel
          return hook(metadata_directory, config_settings)
        File "/private/var/folders/v7/w7h8mbj1131g_gryv3880mn80000gn/T/pip-build-env-kwlthjhr/overlay/lib/python3.13/site-packages/poetry/core/masonry/api.py", line 43, in prepare_metadata_for_build_wheel
          builder = WheelBuilder(poetry, config_settings=config_settings)
        File "/private/var/folders/v7/w7h8mbj1131g_gryv3880mn80000gn/T/pip-build-env-kwlthjhr/overlay/lib/python3.13/site-packages/poetry/core/masonry/builders/wheel.py", line 67, in __init__
          super().__init__(poetry, executable=executable, config_settings=config_settings)
          ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        File "/private/var/folders/v7/w7h8mbj1131g_gryv3880mn80000gn/T/pip-build-env-kwlthjhr/overlay/lib/python3.13/site-packages/poetry/core/masonry/builders/builder.py", line 53, in __init__
          self._meta = Metadata.from_package(self._package)
                       ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
        File "/private/var/folders/v7/w7h8mbj1131g_gryv3880mn80000gn/T/pip-build-env-kwlthjhr/overlay/lib/python3.13/site-packages/poetry/core/masonry/metadata.py", line 71, in from_package
          raise FileNotFoundError(
              f"Readme path `{readme}` does not exist."
          ) from e
      FileNotFoundError: Readme path `/private/var/folders/v7/w7h8mbj1131g_gryv3880mn80000gn/T/pip-install-qd6dgmse/mistralai_9bd9fb408e3a4b30abfdbe72f936d2dd/README-PYPI.md` does not exist.
      [end of output]
  
  note: This error originates from a subprocess, and is likely not a problem with pip.
error: metadata-generation-failed

× Encountered error while generating package metadata.
╰─> mistralai

note: This is an issue with the package mentioned above, not pip.
hint: See above for details.

[hankhank10]

Update: this package has been contaminated with Russian malware. If you deployed this package then your credentials are likely compromised.

https://gbhackers.com/mistralai-pypi-package/

[databaaz]

Until the issue is fixed, as an intermediate solution, you can update your requirements.txt to

mistralai @ https://github.com/mistralai/client-python/archive/refs/tags/v2.4.5.tar.gz

replace 2.4.5 with any previous desired version, except 2.4.6, of course

This wouldn't require git as a dependency in your deploy environment.

[louis-sanna-dev]

Hello all,

Here is our latest security advisory GHSA-wx9m-wx4f-4cmg