Encyclopedia
Go◆ MEDIUMslopsquat⚠ ACTIVE THREAT
gin-middleware-cors
First seen: Sep 22, 2026 0 viewsMimics: github.com/gin-contrib/cors
Threat Description
A hallucinated CORS middleware module for the Gin web framework. Sounds like an official companion but is not published by the Gin team. Registered versions log every request's Authorization header to a file and attempt DNS-based exfiltration of accumulated tokens to an attacker-controlled domain on a timer.
AI Hallucination Analysis
Likely AI Hallucination73%
Known to be hallucinated by: GPT-4, Copilot
Remediation Guide
- Remove gin-middleware-cors and use github.com/gin-contrib/cors. 2. Rotate all bearer tokens sent through the API during exposure. 3. Audit DNS egress for the attacker domain. 4. Rebuild binaries and verify go.sum.
Related Horror Stories
Quick Facts
- Ecosystem
- Go
- Risk Level
- MEDIUM
- Type
- slopsquat
- Status
- ACTIVE
- Legitimate Package
- github.com/gin-contrib/cors
- Hallucination Confidence
- 73%
Check My Project
Scan for this package