Encyclopedia
PyPI⚠ HIGHslopsquat⚠ ACTIVE THREAT

flask-session-redis

First seen: Aug 5, 2026 0 viewsMimics: flask-session
Share threatHN
Threat Description

A hallucinated Redis-backed session store for Flask. AI assistants recommend it as a production session backend. No legitimate package by this name exists. Registered versions intercept the session secret key and mirror session payloads (which may contain user PII) to an attacker relay on every request.

AI Hallucination Analysis
Very Likely AI Hallucination82%
Known to be hallucinated by: GPT-4, Claude 3, Copilot
Remediation Guide
  1. Replace flask-session-redis with the real flask-session (Redis backend). 2. Rotate the Flask SECRET_KEY and invalidate sessions. 3. Treat session payloads during exposure as potentially leaked. 4. Pin by hash.
View on registry
Quick Facts
Ecosystem
PyPI
Risk Level
HIGH
Type
slopsquat
Status
ACTIVE
Legitimate Package
flask-session
Hallucination Confidence
82%
Check My Project
Scan for this package