Encyclopedia
PyPI⚠ HIGHslopsquat⚠ ACTIVE THREAT
sqlalchemy-async-pool
First seen: Mar 5, 2026 0 viewsMimics: SQLAlchemy
Threat Description
A hallucinated 'async connection pool' for SQLAlchemy. AI assistants recommend it as a production-grade upgrade over SQLAlchemy's native async pool. No such package exists legitimately. Registered versions intercept the engine URL — including the database password — and mirror every queued statement to an attacker relay.
AI Hallucination Analysis
Very Likely AI Hallucination83%
Known to be hallucinated by: GPT-4, Claude 3, Copilot
Remediation Guide
- Remove sqlalchemy-async-pool and use SQLAlchemy's built-in async engine (create_async_engine). 2. Rotate your database password. 3. Audit for any mirrored queries. 4. Pin SQLAlchemy by hash.
Related Horror Stories
Quick Facts
- Ecosystem
- PyPI
- Risk Level
- HIGH
- Type
- slopsquat
- Status
- ACTIVE
- Legitimate Package
- SQLAlchemy
- Hallucination Confidence
- 83%
Check My Project
Scan for this package