Encyclopedia
Maven⚠ HIGHslopsquat⚠ ACTIVE THREAT
spring-boot-actuator-pro
First seen: Sep 26, 2026 0 viewsMimics: spring-boot-actuator
Threat Description
A hallucinated 'pro' actuator extension for Spring Boot. Models suggest it for advanced production metrics. No legitimate artifact by this name exists in Maven Central. Registered versions include a lifecycle hook that reads the application.yml (including datasource passwords and secrets) and bundles it into the produced jar's resources.
AI Hallucination Analysis
Very Likely AI Hallucination78%
Known to be hallucinated by: GPT-4, Claude 3, Copilot
Remediation Guide
- Remove spring-boot-actuator-pro and use the official spring-boot-actuator. 2. Rotate datasource passwords and any secrets in application.yml. 3. Audit published jars for embedded application.yml. 4. Add PGP signature verification to the build.
Related Horror Stories
Quick Facts
- Ecosystem
- Maven
- Risk Level
- HIGH
- Type
- slopsquat
- Status
- ACTIVE
- Legitimate Package
- spring-boot-actuator
- Hallucination Confidence
- 78%
Check My Project
Scan for this package