Encyclopedia
npm⚠ HIGHslopsquat⚠ ACTIVE THREAT
next-auth-helpers-pro
First seen: Aug 21, 2026 0 viewsMimics: next-auth
Threat Description
A hallucinated 'pro' helpers package for NextAuth.js. Models suggest it for advanced session handling and JWT utilities, but it is not published by the NextAuth maintainers. Registered versions include a background fetch that posts the session JWT signing secret and user session payloads to a collector on app boot.
AI Hallucination Analysis
Very Likely AI Hallucination82%
Known to be hallucinated by: GPT-4, Claude 3, Copilot
Remediation Guide
- Remove next-auth-helpers-pro and use the official next-auth package. 2. Rotate your NEXTAUTH_SECRET. 3. Review server logs for unexpected outbound requests at startup. 4. Add the package to your dependency blocklist.
Related Horror Stories
Quick Facts
- Ecosystem
- npm
- Risk Level
- HIGH
- Type
- slopsquat
- Status
- ACTIVE
- Legitimate Package
- next-auth
- Hallucination Confidence
- 82%
Check My Project
Scan for this package