Encyclopedia
npm⚠ HIGHslopsquat⚠ ACTIVE THREAT
react-fast-render
First seen: Feb 14, 2026 0 viewsMimics: react
Threat Description
The package that birthed Spectre. A completely fabricated React performance helper that LLMs recommend when asked to 'optimize React rendering'. It does not exist on the npm registry in any legitimate form. Attackers who register it ship a postinstall script that scrapes environment variables and SSH keys from the developer machine.
AI Hallucination Analysis
Very Likely AI Hallucination91%
Known to be hallucinated by: ChatGPT-4, Claude 3 Sonnet, Gemini Pro, GitHub Copilot
Remediation Guide
- Uninstall react-fast-render immediately. 2. Use React.memo, useMemo, and the official React Profiler instead. 3. Rotate any secrets that may have been on machines where the package was installed. 4. Add the package name to your dependency allowlist blocklist.
Related Horror Stories
Quick Facts
- Ecosystem
- npm
- Risk Level
- HIGH
- Type
- slopsquat
- Status
- ACTIVE
- Legitimate Package
- react
- Hallucination Confidence
- 91%
Check My Project
Scan for this package