Encyclopedia
npm⚠ HIGHslopsquat⚠ ACTIVE THREAT

axios-fetch-helper

First seen: Sep 3, 2024 614 viewsMimics: axios
Share threatHN
Threat Description

Hallucinated by multiple LLMs when asked to combine axios and fetch APIs. Installs a keylogger that captures form inputs and submits them to an external endpoint. Frequently suggested by GitHub Copilot.

AI Hallucination Analysis
Very Likely AI Hallucination85%
Known to be hallucinated by: GitHub Copilot, ChatGPT-3.5
Remediation Guide
  1. Remove "axios-fetch-helper" from your dependencies immediately.
  2. Replace with the legitimate package "axios" if applicable.
  3. Audit your codebase for any imports or usage of the malicious package.
  4. Check your CI/CD logs for when this package was introduced.
  5. Rotate any exposed secrets (API keys, tokens) that may have been exfiltrated.
Quick Facts
Ecosystem
npm
Risk Level
HIGH
Type
slopsquat
Status
ACTIVE
Legitimate Package
axios
Hallucination Confidence
85%
Check My Project
Scan for this package