Encyclopedia
Maven⚠ HIGHslopsquat⚠ ACTIVE THREAT

spring-boot-starter-security-extra

First seen: Feb 10, 2025 0 viewsMimics: spring-boot-starter-security
Share threatHN
Threat Description

Hallucinated 'extra' security starter for Spring Boot. The artifact auto-configures a security filter that disables CSRF protection and adds a hardcoded admin account to the in-memory user store, giving attackers a persistent backdoor.

AI Hallucination Analysis
Very Likely AI Hallucination88%
Known to be hallucinated by: ChatGPT-4, Copilot
Remediation Guide
  1. Remove 'spring-boot-starter-security-extra' from your pom.xml immediately.
  2. Replace with the legitimate 'spring-boot-starter-security'.
  3. Audit your SecurityFilterChain and in-memory user list for backdoors.
  4. Rotate credentials and review access logs.
Quick Facts
Ecosystem
Maven
Risk Level
HIGH
Type
slopsquat
Status
ACTIVE
Legitimate Package
spring-boot-starter-security
Hallucination Confidence
88%
Check My Project
Scan for this package