Threat Description
A Go package that doesn't exist in any legitimate form, yet is consistently suggested by AI tools. The malicious version on pkg.go.dev exfiltrates HTTP request contents including Authorization headers.
AI Hallucination Analysis
Very Likely AI Hallucination90%
Known to be hallucinated by: ChatGPT-4, Gemini 1.5 Pro
Remediation Guide
- Remove "go-http-client-utils" from your dependencies immediately.
- Replace with the legitimate package "a well-known alternative" if applicable.
- Audit your codebase for any imports or usage of the malicious package.
- Check your CI/CD logs for when this package was introduced.
- Rotate any exposed secrets (API keys, tokens) that may have been exfiltrated.
Quick Facts
- Ecosystem
- Go
- Risk Level
- HIGH
- Type
- phantom
- Status
- ACTIVE
- Hallucination Confidence
- 90%
Check My Project
Scan for this package