• TeamPCP hackers stole 450 repositories from Mistral AI and are auctioning them on the dark web for ~$25K
• Data includes ~5GB of internal source code for training, fine‑tuning, benchmarking, and model delivery
• Group warned if no buyer emerges soon, they’ll leak everything for free; Mistral confirmed SDK contamination but said core systems and user data were unaffected

Hackers who recently stole 450 repositories from Mistral AI are now offering the large set of data to the highest bidder on the dark web - but if a buyer doesn’t appear soon they will leak everything for free.

The TeamPCP hacking group recently launched a supply chain attack called Mini Shai-Hulud against the TanStack npm package. TanStack is a collection of free software designed for building user interfaces with more than 177 million weekly downloads.

By poisoning the package, TeamPCP managed to distribute an infostealer malware which harvested developer credentials, cloud secrets, and SSH keys.

Flexible price

In a statement shared with BleepingComputer, Mistral AI confirmed the criminals compromised a codebase management system.

“They contaminated some of our SDK packages for a brief period,” the company said, stressing that the impacted data was not part of the core code repositories: “Neither our hosted services, managed user data, nor any of our research and testing environments were compromised,” Mistral said.

This didn’t stop TeamPCP from advertising the loot on the dark web for no more than $25,000 They’re saying they stole five gigabytes of “internal repositories and source code” allegedly used for training, fine-tuning, benchmarking, model delivery, and inference in experiments and future projects.

The sale is exclusive, meaning just one person will be getting the goods. TeamPCP also invited Mistral AI to buy it, and said that if a buyer isn’t found within a week, everything will be leaked to the forums for free.

The $25K price is negotiable, they said, and invited other actors to offer what they feel is a reasonable price.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.