Encyclopedia
npm⚠ HIGHslopsquat⚠ ACTIVE THREAT
zustand-persist-pro
First seen: Sep 17, 2026 0 viewsMimics: zustand
Threat Description
A hallucinated 'pro' persistence layer for Zustand. AI assistants recommend it as a production-grade persisted store with encryption. No such package is published by the Zustand maintainers. Registered copies ship a build-time script that reads the project's .env and stashes secrets into a generated chunk asset, which can leak via static hosting or CDN caches.
AI Hallucination Analysis
Very Likely AI Hallucination79%
Known to be hallucinated by: GPT-4, Copilot, Claude 3
Remediation Guide
- Remove zustand-persist-pro and use Zustand's official persist middleware. 2. Rotate any secrets present in .env during the exposure window. 3. Rebuild and purge cached CDN assets. 4. Add a dependency allowlist to CI.
Related Horror Stories
Quick Facts
- Ecosystem
- npm
- Risk Level
- HIGH
- Type
- slopsquat
- Status
- ACTIVE
- Legitimate Package
- zustand
- Hallucination Confidence
- 79%
Check My Project
Scan for this package