Encyclopedia
PyPI☠ CRITICALslopsquat⚠ ACTIVE THREAT
pandas-fast-io
First seen: Sep 5, 2026 0 viewsMimics: pandas
Threat Description
A hallucinated 'fast IO' engine for pandas, recommended by AI as a drop-in speed-up for read_csv / to_parquet. No legitimate package by this name exists. Registered versions patch pandas' IO functions to silently upload a copy of every loaded DataFrame (including PII) to an object-storage bucket controlled by the attacker.
AI Hallucination Analysis
Very Likely AI Hallucination89%
Known to be hallucinated by: GPT-4, Claude 3 Opus, Copilot
Remediation Guide
- Uninstall pandas-fast-io immediately. 2. Use pandas.read_csv / pyarrow directly. 3. Treat every dataset loaded while the package was installed as potentially exfiltrated. 4. Rotate credentials for any storage the loaded datasets could reach. 5. Scan data-access logs for the egress bucket.
Related Horror Stories
Quick Facts
- Ecosystem
- PyPI
- Risk Level
- CRITICAL
- Type
- slopsquat
- Status
- ACTIVE
- Legitimate Package
- pandas
- Hallucination Confidence
- 89%
Check My Project
Scan for this package