Mistral SDK (JS)
npm@mistralai/mistralaiThe Mistral AI JavaScript SDK provides access to Mistral Large, Mixtral, and codestral models from Node.js applications. It covers chat completions, function calling, and embeddings. It is used in Node.js backends that route requests to Mistral models for cost or capability reasons.
Checking Mistral SDK (JS)
@mistralai/mistralai 1.0.0 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.
curl "https://api.attestd.io/v1/check?product=%40mistralai%2Fmistralai&version=1.0.0" \
-H "Authorization: Bearer YOUR_API_KEY"{
"product": "@mistralai/mistralai",
"version": "1.0.0",
"supported": true,
"risk_state": "none",
"risk_factors": [],
"actively_exploited": false,
"remote_exploitable": false,
"authentication_required": false,
"patch_available": false,
"fixed_version": null,
"confidence": 0.9,
"cve_ids": [],
"cves": null,
"max_epss": null,
"typosquat": null,
"supply_chain_monitored": true,
"supply_chain": {
"compromised": false,
"sources": [],
"malware_type": null,
"description": null,
"advisory_url": null,
"compromised_at": null,
"removed_at": null
},
"last_updated": "2026-05-01T00:00:00Z"
}Why this package is monitored
The Mistral JS SDK carries chat, embeddings, and codestral traffic for backends that route work off larger providers. Compromise exposes the Mistral API key plus prompt and completion content on every Node call path.
Attestd monitors @mistralai/mistralai using the following detection sources:
registryManually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.
osvOSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.
npm_deprecationnpm package versions with deprecation messages containing targeted attack language such as malicious, backdoor, or compromised. Confidence 0.80.