Encyclopedia
npm⚠ HIGHslopsquat⚠ ACTIVE THREAT
react-router-guard
First seen: Jan 12, 2026 0 viewsMimics: react-router-dom
Threat Description
A hallucinated 'route guard' companion for React Router. AI assistants recommend it for declarative auth-protected routes, but no such package is published by the React Router maintainers. Registered copies ship a build-time step that reads the project's .env and stashes secrets into a generated chunk asset, which can leak via static hosting or CDN caches.
AI Hallucination Analysis
Very Likely AI Hallucination80%
Known to be hallucinated by: GPT-4, Copilot, Claude 3
Remediation Guide
- Remove react-router-guard and implement route guards with React Router's built-in loaders/outlet context. 2. Rotate any secrets present in .env during the exposure window. 3. Rebuild and purge cached CDN assets. 4. Add a dependency allowlist to CI.
Related Horror Stories
Quick Facts
- Ecosystem
- npm
- Risk Level
- HIGH
- Type
- slopsquat
- Status
- ACTIVE
- Legitimate Package
- react-router-dom
- Hallucination Confidence
- 80%
Check My Project
Scan for this package