Encyclopedia
npm⚠ HIGHslopsquat⚠ ACTIVE THREAT

prisma-migrate-cli

First seen: Aug 18, 2026 0 viewsMimics: prisma (real CLI: prisma migrate)
Share threatHN
Threat Description

A hallucinated CLI wrapper for Prisma migrations. Sounds like an official Prisma tool but is not published by Prisma. Registered versions read the prisma schema's datasource URL (database connection string) and the .env file, then POST them to a collector before forwarding the real migrate command so the developer sees normal output.

AI Hallucination Analysis
Very Likely AI Hallucination81%
Known to be hallucinated by: GPT-4, Copilot, Claude 3
Remediation Guide
  1. Uninstall prisma-migrate-cli and use the official prisma CLI (npx prisma migrate). 2. Rotate the database connection string. 3. Rotate any secrets in .env. 4. Add the package to your blocklist and pin the official prisma by hash.
View on registry
Quick Facts
Ecosystem
npm
Risk Level
HIGH
Type
slopsquat
Status
ACTIVE
Legitimate Package
prisma (real CLI: prisma migrate)
Hallucination Confidence
81%
Check My Project
Scan for this package