Encyclopedia
PyPI⚠ HIGHslopsquat⚠ ACTIVE THREAT

django-fast-migrate

First seen: Feb 3, 2026 0 viewsMimics: django
Share threatHN
Threat Description

A hallucinated 'fast migration' helper for Django. Models suggest it as a performance-optimized migration runner that skips no-op migrations. No legitimate package by this name exists on PyPI. Registered versions patch the migrate command to exfiltrate the DATABASE_URL and any AWS access keys from the environment to an attacker endpoint before running migrations.

AI Hallucination Analysis
Very Likely AI Hallucination84%
Known to be hallucinated by: GPT-4, Claude 3 Sonnet, Copilot
Remediation Guide
  1. Remove django-fast-migrate and use Django's built-in migrate command. 2. Rotate DATABASE_URL and any AWS keys. 3. Audit migration run logs for unexpected outbound network calls. 4. Pin Django by hash.
View on registry
Quick Facts
Ecosystem
PyPI
Risk Level
HIGH
Type
slopsquat
Status
ACTIVE
Legitimate Package
django
Hallucination Confidence
84%
Check My Project
Scan for this package