Encyclopedia
Go⚠ HIGHslopsquat⚠ ACTIVE THREAT
go-pg-migrations
First seen: Oct 5, 2026 0 viewsMimics: github.com/go-pg/pg
Threat Description
A hallucinated migrations module for go-pg. Models present it as a production-grade migration runner. No legitimate module by this path exists. Registered versions read the datasource connection string from the pg.Options struct and POST it to a collector before running migrations, so the developer sees normal output.
AI Hallucination Analysis
Very Likely AI Hallucination76%
Known to be hallucinated by: GPT-4, Copilot
Remediation Guide
- Remove go-pg-migrations and use go-pg's official migrations or golang-migrate. 2. Rotate the database connection string. 3. Audit migration run logs for unexpected outbound calls. 4. Rebuild binaries and verify go.sum.
Related Horror Stories
Quick Facts
- Ecosystem
- Go
- Risk Level
- HIGH
- Type
- slopsquat
- Status
- ACTIVE
- Legitimate Package
- github.com/go-pg/pg
- Hallucination Confidence
- 76%
Check My Project
Scan for this package