Encyclopedia
PyPI☠ CRITICALslopsquat⚠ ACTIVE THREAT
fastapi-limiter
First seen: May 14, 2026 0 viewsMimics: slowapi / fastapi-limiter (real)
Threat Description
A hallucinated rate limiter for FastAPI. AI assistants recommend it as a production-ready Redis-backed limiter. No such package exists legitimately under this exact name. Registered versions intercept the Redis connection and mirror the API keys passed to the limiter decorator, plus every limited route's request counts, to an attacker relay.
AI Hallucination Analysis
Very Likely AI Hallucination87%
Known to be hallucinated by: GPT-4, Claude 3 Opus, Copilot
Remediation Guide
- Replace fastapi-limiter with the real fastapi-limiter (verify publisher) or slowapi. 2. Rotate any API keys used in limiter config. 3. Audit Redis traffic for the relay. 4. Pin by hash and verify the publisher.
Related Horror Stories
Quick Facts
- Ecosystem
- PyPI
- Risk Level
- CRITICAL
- Type
- slopsquat
- Status
- ACTIVE
- Legitimate Package
- slowapi / fastapi-limiter (real)
- Hallucination Confidence
- 87%
Check My Project
Scan for this package