Encyclopedia
npm☠ CRITICALphantom⚠ ACTIVE THREAT

react-fast-render

First seen: Feb 14, 2024 0 views
Share threatHN
Threat Description

The phantom package that birthed Spectre. Consistently hallucinated by early LLMs as a 'fast React renderer', it never existed on the registry until an attacker registered it knowing an AI would recommend it. The install script exfiltrates .env files and SSH keys silently.

AI Hallucination Analysis
Very Likely AI Hallucination94%
Known to be hallucinated by: ChatGPT-3.5, GitHub Copilot, Claude 2
Remediation Guide
  1. Remove 'react-fast-render' from your dependencies immediately.
  2. There is no legitimate package — remove the import and use React's built-in renderer.
  3. Audit your codebase for any imports of the malicious package.
  4. Rotate all .env secrets and SSH keys that may have been exfiltrated.
Related Horror Stories
Barcelona to Nowhere👍 38
Quick Facts
Ecosystem
npm
Risk Level
CRITICAL
Type
phantom
Status
ACTIVE
Hallucination Confidence
94%
Check My Project
Scan for this package