Database
Slopsquat Encyclopedia
84 known threats indexed. Search by package name, ecosystem, or risk type.
84 results
npm
ffmepg
A typosquat of the ffmpeg package name from the August 2017 npm typosquat campai
◆ MEDIUMtyposquatACTIVE
npm
gruntcli
A typosquat of grunt-cli from the August 2017 npm typosquat campaign. It imperso
◆ MEDIUMtyposquatACTIVE
npm
electorn
A typosquat of the Electron framework (transposed 'r' and 'o'), documented by So
⚠ HIGHtyposquatACTIVE
npm
lodashs
A typosquat of the lodash utility library (extra trailing 's'), published by the
⚠ HIGHtyposquatACTIVE
PyPI
jeilyfish
A typosquat of the jellyfish library (a capital 'i' and lowercase 'L' instead of
☠ CRITICALtyposquatACTIVE
PyPI
python3-dateutil
A typosquat of the python-dateutil library, detected on PyPI in December 2021 an
☠ CRITICALtyposquatACTIVE
PyPI
ctx
A dependency-confusion (phantom) package on PyPI, part of the 2021 dependency-co
⚠ HIGHphantomACTIVE
npm
crossenv
A typosquat of the legitimate cross-env package, part of the August 2017 npm typ
⚠ HIGHtyposquatACTIVE
npm
babelcli
A typosquat of babel-cli from the August 2017 npm typosquat campaign (same wave
◆ MEDIUMtyposquatACTIVE
npm
mongose
A typosquat of the MongoDB ODM mongoose from the August 2017 npm typosquat campa
◆ MEDIUMtyposquatACTIVE
npm
zustand-persist-pro
A hallucinated 'pro' persistence layer for Zustand. AI assistants recommend it a
⚠ HIGHslopsquatACTIVE
PyPI
pydantic-fast-validator
A hallucinated 'fast validator' companion for Pydantic. Models present it as a C
⚠ HIGHslopsquatACTIVE
Go
gin-middleware-cors
A hallucinated CORS middleware module for the Gin web framework. Sounds like an
◆ MEDIUMslopsquatACTIVE
RubyGems
sidekiq-reliable-fetch
A hallucinated 'reliable fetch' gem for Sidekiq. AI assistants recommend it for
⚠ HIGHslopsquatACTIVE
Maven
spring-boot-actuator-pro
A hallucinated 'pro' actuator extension for Spring Boot. Models suggest it for a
⚠ HIGHslopsquatACTIVE
npm
sveltekit-auth-helpers
A hallucinated auth helpers package for SvelteKit. Sounds like an official Svelt
⚠ HIGHslopsquatACTIVE
PyPI
httpx-retry-async
A hallucinated async retry layer for httpx. Sounds like an official companion bu
◆ MEDIUMslopsquatACTIVE
npm
express-rate-limit-pro
A hallucinated 'pro' rate limiter for Express. AI assistants recommend it as a p
⚠ HIGHslopsquatACTIVE
Go
go-pg-migrations
A hallucinated migrations module for go-pg. Models present it as a production-gr
⚠ HIGHslopsquatACTIVE
PyPI
django-rest-fast
A hallucinated 'fast' REST framework layer for Django. AI assistants recommend i
☠ CRITICALslopsquatACTIVE
Go
go-cache-redis
A hallucinated 'Redis-backed cache' module for Go. Models present it as a drop-i
⚠ HIGHslopsquatACTIVE
RubyGems
rails-auth-jwt
A hallucinated JWT auth gem for Rails. Sounds like a natural companion to Devise
⚠ HIGHslopsquatACTIVE
Maven
maven-shade-pro
A hallucinated 'pro' Maven Shade plugin wrapper. AI assistants suggest it for ad
◆ MEDIUMslopsquatACTIVE
npm
vue-i18n-loader
A hallucinated i18n loader for Vue. Sounds like an official Vue ecosystem packag
◆ MEDIUMslopsquatACTIVE
PyPI
fastapi-limiter
A hallucinated rate limiter for FastAPI. AI assistants recommend it as a product
☠ CRITICALslopsquatACTIVE
PyPI
reqests
A typosquat of the ubiquitous 'requests' library — a single transposed letter ('
☠ CRITICALtyposquatACTIVE
PyPI
numpy-fast-vec
A hallucinated 'fast vectorized' numpy companion. AI assistants recommend it as
☠ CRITICALslopsquatACTIVE
Go
go-jwt-middleware
A hallucinated JWT middleware module for Go. Models present it as a production-g
⚠ HIGHslopsquatACTIVE
npm
lodahs
A typosquat of lodash — transposed 'a' and 'h' ('lodahs' vs 'lodash'). Registere
☠ CRITICALtyposquatACTIVE
PyPI
flask-session-redis
A hallucinated Redis-backed session store for Flask. AI assistants recommend it
⚠ HIGHslopsquatACTIVE
npm
prisma-migrate-cli
A hallucinated CLI wrapper for Prisma migrations. Sounds like an official Prisma
⚠ HIGHslopsquatACTIVE
npm
react-router-guard
A hallucinated 'route guard' companion for React Router. AI assistants recommend
⚠ HIGHslopsquatACTIVE
PyPI
django-fast-migrate
A hallucinated 'fast migration' helper for Django. Models suggest it as a perfor
⚠ HIGHslopsquatACTIVE
npm
axios-retry-pro
A hallucinated 'pro' retry layer for axios. Sounds like an official companion bu
◆ MEDIUMslopsquatACTIVE
PyPI
sqlalchemy-async-pool
A hallucinated 'async connection pool' for SQLAlchemy. AI assistants recommend i
⚠ HIGHslopsquatACTIVE
PyPI
pandas-fast-io
A hallucinated 'fast IO' engine for pandas, recommended by AI as a drop-in speed
☠ CRITICALslopsquatACTIVE
npm
tailwind-merge-utils
A hallucinated utility set wrapping tailwind-merge. Sounds like an official comp
◆ MEDIUMslopsquatACTIVE
npm
next-auth-helpers-pro
A hallucinated 'pro' helpers package for NextAuth.js. Models suggest it for adva
⚠ HIGHslopsquatACTIVE
PyPI
langchain-fast-store
A hallucinated 'fast vector store' companion for LangChain. AI assistants recomm
⚠ HIGHslopsquatACTIVE
PyPI
redis-async-pool
A hallucinated 'async connection pool' for Redis, recommended by AI as a product
⚠ HIGHslopsquatACTIVE
npm
react-fast-render
The package that birthed Spectre. A completely fabricated React performance help
⚠ HIGHslopsquatACTIVE
PyPI
django-rest-fast
A hallucinated 'fast serializer' companion to Django REST Framework. Models sugg
⚠ HIGHslopsquatACTIVE
npm
axios-retry-helper
A hallucinated retry wrapper around axios. Sounds identical to the legitimate 'a
◆ MEDIUMslopsquatACTIVE
PyPI
fastapi-limiter-pro
A hallucinated 'pro' rate-limiter for FastAPI, recommended by AI assistants as a
⚠ HIGHslopsquatACTIVE
PyPI
mistral-sdk-fast
A hallucinated 'lightweight async client' for a well-known European AI lab's pla
☠ CRITICALslopsquatACTIVE
npm
webpack-dev-server-utils
Hallucinated utility layer for webpack-dev-server. The registered version opens
⚠ HIGHslopsquatACTIVE
PyPI
boto3-session-manager
Hallucinated session manager for boto3. The package reads the AWS credentials ch
⚠ HIGHslopsquatACTIVE
RubyGems
rails-admin-ui
Hallucinated admin UI gem for Rails. The gem registers a hidden admin route that
⚠ HIGHslopsquatACTIVE
PyPI
flask-sqlalchemy-session
Hallucinated session helper for Flask-SQLAlchemy. The package patches the sessio
⚠ HIGHslopsquatACTIVE
PyPI
pyjwt-utils
Hallucinated JWT utility for PyJWT. The package weakens token verification to ac
◆ MEDIUMslopsquatACTIVE
PyPI
numpy-array-utils
Hallucinated array helper for numpy. The package bundles a lightweight cryptomin
◆ MEDIUMslopsquatACTIVE
Maven
jackson-databind-extra
Hallucinated 'extra' module for jackson-databind. The artifact re-enables polymo
⚠ HIGHslopsquatACTIVE
Go
go-resty-client
A phantom Go HTTP client that AI tools suggest as a 'simpler' alternative to go-
⚠ HIGHphantomACTIVE
npm
react-fast-render
The phantom package that birthed Spectre. Consistently hallucinated by early LLM
☠ CRITICALphantomACTIVE
npm
chalk-cli-color
Typosquat of 'chalk' banking on the 'cli-color' naming confusion. The package pa
⚠ HIGHtyposquatACTIVE
npm
lodash-merge-deep
Hallucinated deep-merge helper for lodash. The package monkeypatches Object.prot
⚠ HIGHslopsquatACTIVE
Maven
log4j-overwrite
Typosquat exploiting the post-Log4Shell confusion around log4j naming. The artif
☠ CRITICALtyposquatACTIVE
npm
npm-install-check
A phantom CLI tool AI assistants suggest to 'validate installs'. The registered
◆ MEDIUMphantomACTIVE
Go
gorm-migrator
Hallucinated migration helper for GORM. The module injects a migration that crea
⚠ HIGHslopsquatACTIVE
RubyGems
devise-auth-jwt
Hallucinated JWT authentication gem for Devise. The package patches Devise's ses
⚠ HIGHslopsquatACTIVE
RubyGems
sidekiq-cron-scheduler
Hallucinated scheduler for Sidekiq. The gem registers a hidden recurring job tha
◆ MEDIUMslopsquatACTIVE
Maven
commons-io-utils
Typosquat of Apache Commons IO. The malicious artifact bundles a JAR that scans
⚠ HIGHtyposquatACTIVE
Maven
spring-boot-starter-security-extra
Hallucinated 'extra' security starter for Spring Boot. The artifact auto-configu
⚠ HIGHslopsquatACTIVE
npm
lodahs
Typosquat of the ubiquitous utility library 'lodash'. The malicious package ship
⚠ HIGHtyposquatACTIVE
npm
axio
Typosquat of 'axios'. The package intercepts all outgoing HTTP requests made thr
⚠ HIGHtyposquatACTIVE
npm
react-native-reanimated-carplay
A phantom package that does not exist in any legitimate form, yet is consistentl
☠ CRITICALphantomACTIVE
npm
ideal-octo-goggles
A documented AI-hallucinated package name of the auto-generated 'adjective-noun-
⚠ HIGHphantomACTIVE
npm
express-rate-limiter-pro
Hallucinated 'pro' tier of express-rate-limit. The package reads process.env on
⚠ HIGHslopsquatACTIVE
npm
mongoose-slug-generator
A hallucinated slug generator for Mongoose. The registered malicious version wri
☠ CRITICALslopsquatACTIVE
PyPI
reqeusts
Typosquat of the most-installed Python HTTP library 'requests'. The malicious pa
☠ CRITICALtyposquatACTIVE
PyPI
python3-dateutil
Typosquat of 'python-dateutil' exploiting the common confusion around Python 2/3
⚠ HIGHtyposquatACTIVE
PyPI
djang
Typosquat of 'django'. The package patches Django's settings loader to disable A
⚠ HIGHtyposquatACTIVE
PyPI
opencv-python-headless-utils
Hallucinated utility layer for opencv-python-headless. The registered version bu
⚠ HIGHslopsquatACTIVE
PyPI
tensorflow-gpu-utils
Hallucinated GPU helper for TensorFlow. The package collects CUDA device info an
◆ MEDIUMslopsquatACTIVE
Go
github.com/g1n-gonic/gin
Typosquat of the popular Gin web framework, swapping 'i' for '1' in the module p
⚠ HIGHtyposquatACTIVE
Go
go-redis-client
A phantom Go Redis client that AI tools suggest as a 'simpler alternative' to go
⚠ HIGHphantomACTIVE
npm
node-file-loader-utils
Typosquat of the popular 'file-loader' webpack plugin. Contains obfuscated code
⚠ HIGHtyposquatACTIVE
PyPI
flask-restapi-helper
Fake Flask REST helper suggested by multiple AI tools. Adds a hidden admin endpo
◆ MEDIUMslopsquatACTIVE
npm
axios-fetch-helper
Hallucinated by multiple LLMs when asked to combine axios and fetch APIs. Instal
⚠ HIGHslopsquatACTIVE
PyPI
pandas-ml-utils
Hallucinated by AI coding assistants as a pandas ML extension. Contains a revers
⚠ HIGHslopsquatACTIVE
RubyGems
ruby-json-parser-fast
Hallucinated fast JSON parser for Ruby. Replaces the native JSON gem's parse met
◆ MEDIUMslopsquatACTIVE
PyPI
python-requests-async
A phantom package that ChatGPT consistently hallucinates when asked for async HT
☠ CRITICALslopsquatACTIVE
Go
go-http-client-utils
A Go package that doesn't exist in any legitimate form, yet is consistently sugg
⚠ HIGHphantomACTIVE
npm
crypt0-utils
A malicious package hallucinated by ChatGPT and Claude when asked for 'a lightwe
☠ CRITICALslopsquatACTIVE