Encyclopedia
PyPI⚠ HIGHslopsquat⚠ ACTIVE THREAT

pandas-ml-utils

First seen: Dec 1, 2024 390 viewsMimics: pandas
Share threatHN
Threat Description

Hallucinated by AI coding assistants as a pandas ML extension. Contains a reverse shell payload that activates 30 days after installation, making it extremely difficult to attribute.

AI Hallucination Analysis
Very Likely AI Hallucination85%
Known to be hallucinated by: Copilot, Cursor AI
Remediation Guide
  1. Remove "pandas-ml-utils" from your dependencies immediately.
  2. Replace with the legitimate package "pandas" if applicable.
  3. Audit your codebase for any imports or usage of the malicious package.
  4. Check your CI/CD logs for when this package was introduced.
  5. Rotate any exposed secrets (API keys, tokens) that may have been exfiltrated.
Quick Facts
Ecosystem
PyPI
Risk Level
HIGH
Type
slopsquat
Status
ACTIVE
Legitimate Package
pandas
Hallucination Confidence
85%
Check My Project
Scan for this package