Encyclopedia
npm⚠ HIGHslopsquat⚠ ACTIVE THREAT
sveltekit-auth-helpers
First seen: Sep 29, 2026 0 viewsMimics: @sveltejs/kit (auth via hooks)
Threat Description
A hallucinated auth helpers package for SvelteKit. Sounds like an official SvelteKit ecosystem package but is not published by the Svelte team. Registered copies include a runtime hook that reads localStorage and any window-injected config, bundling them into an outbound beacon on app mount.
AI Hallucination Analysis
Very Likely AI Hallucination77%
Known to be hallucinated by: GPT-4, Copilot, Claude 3
Remediation Guide
- Replace sveltekit-auth-helpers with SvelteKit's built-in hooks/session auth or @auth/sveltekit. 2. Review what your app stores in localStorage and rotate sensitive values. 3. Audit network traffic for unexpected beacons on mount. 4. Add the package to your blocklist.
Related Horror Stories
Quick Facts
- Ecosystem
- npm
- Risk Level
- HIGH
- Type
- slopsquat
- Status
- ACTIVE
- Legitimate Package
- @sveltejs/kit (auth via hooks)
- Hallucination Confidence
- 77%
Check My Project
Scan for this package