Legitimate serde_json crate. All findings are false positives from normal JSON escape handling (\x00, \uDEAD, \x08 etc.), comment separators, long numeric test literals, and module paths like de::/f64:: being misread as IPs. No malicious code, network, or exfil behavior present.
AI breakdown
Plain-English summary of what this package does and how it behaves.
serde_json 1.0.151 is the well-known Rust crate for JSON serialization and deserialization via the serde framework.
Capabilities
- Parses JSON data
- Serializes Rust types to JSON
- Runs a build script (build.rs)
- Lexical number parsing
Data access
- Filesystem (build and source files)
Network
- No network access observed
Static findings flag obfuscated sources and hardcoded IPs, but file contents match the standard legitimate serde_json library with no scripts or network dependencies observed.
Security findings (12)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in src/de.rs
Multiple obfuscation patterns in serde_json-1.0.151/src/de.rs
Multiple obfuscation patterns in src/read.rs
Multiple obfuscation patterns in serde_json-1.0.151/src/read.rs
Multiple obfuscation patterns in tests/test.rs
Multiple obfuscation patterns in serde_json-1.0.151/tests/test.rs
File src/de.rs contains a hardcoded public IP (de::) used in network code — review for hidden exfiltration or C2 endpoints.
File serde_json-1.0.151/src/de.rs contains a hardcoded public IP (de::) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/regression/issue845.rs contains a hardcoded public IP (D::) used in network code — review for hidden exfiltration or C2 endpoints.
File serde_json-1.0.151/tests/regression/issue845.rs contains a hardcoded public IP (D::) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/test.rs contains a hardcoded public IP (f64::) used in network code — review for hidden exfiltration or C2 endpoints.
File serde_json-1.0.151/tests/test.rs contains a hardcoded public IP (f64::) used in network code — review for hidden exfiltration or C2 endpoints.
Files in package (178)
How ShadowCanopy checks crates.io packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/crates/serde_json