Encyclopedia
PyPI☠ CRITICALslopsquat⚠ ACTIVE THREAT

python-requests-async

First seen: Oct 1, 2024 1205 viewsMimics: httpx
Share threatHN
Threat Description

A phantom package that ChatGPT consistently hallucinates when asked for async HTTP requests in Python. The real package is 'httpx' or 'aiohttp'. The malicious version steals AWS credentials from ~/.aws/credentials.

AI Hallucination Analysis
Very Likely AI Hallucination85%
Known to be hallucinated by: ChatGPT-4o, ChatGPT-4, Claude 3
Remediation Guide
  1. Remove "python-requests-async" from your dependencies immediately.
  2. Replace with the legitimate package "httpx" if applicable.
  3. Audit your codebase for any imports or usage of the malicious package.
  4. Check your CI/CD logs for when this package was introduced.
  5. Rotate any exposed secrets (API keys, tokens) that may have been exfiltrated.
Quick Facts
Ecosystem
PyPI
Risk Level
CRITICAL
Type
slopsquat
Status
ACTIVE
Legitimate Package
httpx
Hallucination Confidence
85%
Check My Project
Scan for this package