Is fastapi (PyPI) safe to install?

fastapi matches a known-malicious advisory (MAL-2026-4750) in ShadowCanopy's live threat intelligence and is blocked by default across every project.

fastapi is flagged malicious (PyPI) — ShadowCanopy

Dangerous — known malicious

This package matches a known-malicious advisory and is blocked by ShadowCanopy by default.

Scanned 10/25/2026

Known maliciousfastapi@0.162.0View on registry ↗latest: 0.162.0

This package matches a known-malicious advisory (MAL-2026-4750) and is blocked by ShadowCanopy by default across every project. 1 flagged version.

All flagged files are tests or doc-generation scripts (Playwright screenshot helpers + SSE edge-case tests). The subprocess + localhost httpx calls start the project's own dev server to capture docs images; the \u2028/\x0b cases are explicit test vectors for format_sse_event. No malicious behavior in library code.

Protect your projects free

AI breakdown

Plain-English summary of what this package does and how it behaves.

Package named fastapi version 0.162.0, described as the FastAPI framework for building high-performance APIs. Sample files consist of LICENSE, README, and numerous documentation/tutorial Python examples. Static findings report multiple instances of obfuscated source files, remote fetch with process execution, and hardcoded public IPs.

Capabilities

Obfuscated source file
Remote fetch with process execution
Hardcoded public IP in network code

Data access

None observed

Network

Remote fetch with process execution
Hardcoded public IP in network code

Presented as a web framework with extensive docs but includes multiple static findings for remote execution and obfuscation that warrant code review before installation.

Dependency & execution chain

Every package this one pulls in, colored by verdict. Expand to walk the tree.

14 packages7 direct

fastapi@0.162.022 findings

starlette@1.10.014 findings

pydantic@2.14.3

typing-extensions@4.16.04 findings

typing-inspection@0.4.5

annotated-doc@0.0.5

opentelemetry-api@1.45.28 findings

Security findings (22)

Static analysis rule matches, with the exact code that triggered them.

mediumObfuscated source fileATK-023tests/test_sse.py

Multiple obfuscation patterns in tests/test_sse.py

mediumObfuscated source fileATK-023fastapi-0.162.0/tests/test_sse.py

Multiple obfuscation patterns in fastapi-0.162.0/tests/test_sse.py

highRemote fetch with process executionATK-024scripts/playwright/cookie_param_models/image01.py

File scripts/playwright/cookie_param_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.162.0/scripts/playwright/cookie_param_models/image01.py

File fastapi-0.162.0/scripts/playwright/cookie_param_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024scripts/playwright/header_param_models/image01.py

File scripts/playwright/header_param_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.162.0/scripts/playwright/header_param_models/image01.py

File fastapi-0.162.0/scripts/playwright/header_param_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024scripts/playwright/json_base64_bytes/image01.py

File scripts/playwright/json_base64_bytes/image01.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.162.0/scripts/playwright/json_base64_bytes/image01.py

File fastapi-0.162.0/scripts/playwright/json_base64_bytes/image01.py combines network access with process execution

highRemote fetch with process executionATK-024scripts/playwright/query_param_models/image01.py

File scripts/playwright/query_param_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.162.0/scripts/playwright/query_param_models/image01.py

File fastapi-0.162.0/scripts/playwright/query_param_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024scripts/playwright/request_form_models/image01.py

File scripts/playwright/request_form_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.162.0/scripts/playwright/request_form_models/image01.py

File fastapi-0.162.0/scripts/playwright/request_form_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024scripts/playwright/sql_databases/image01.py

File scripts/playwright/sql_databases/image01.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.162.0/scripts/playwright/sql_databases/image01.py

File fastapi-0.162.0/scripts/playwright/sql_databases/image01.py combines network access with process execution

highRemote fetch with process executionATK-024scripts/playwright/sql_databases/image02.py

File scripts/playwright/sql_databases/image02.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.162.0/scripts/playwright/sql_databases/image02.py

File fastapi-0.162.0/scripts/playwright/sql_databases/image02.py combines network access with process execution

highRemote fetch with process executionATK-024scripts/sponsors.py

File scripts/sponsors.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.162.0/scripts/sponsors.py

File fastapi-0.162.0/scripts/sponsors.py combines network access with process execution

highHardcoded public IP in network codeATK-028tests/test_telemetry/test_semantic_conventions.py

File tests/test_telemetry/test_semantic_conventions.py contains a hardcoded public IP (2001:db8::1) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028fastapi-0.162.0/tests/test_telemetry/test_semantic_conventions.py

File fastapi-0.162.0/tests/test_telemetry/test_semantic_conventions.py contains a hardcoded public IP (2001:db8::1) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028tests/test_tutorial/test_extra_data_types/test_tutorial001.py

File tests/test_tutorial/test_extra_data_types/test_tutorial001.py contains a hardcoded public IP (15:30:00) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028fastapi-0.162.0/tests/test_tutorial/test_extra_data_types/test_tutorial001.py

File fastapi-0.162.0/tests/test_tutorial/test_extra_data_types/test_tutorial001.py contains a hardcoded public IP (15:30:00) used in network code — review for hidden exfiltration or C2 endpoints.

Package metadata

LicenseUnknown

FastAPI framework, high performance, easy to learn, fast to code, ready for production

Files in package (500)

LICENSEfastapi-0.162.0/LICENSEREADME.mdfastapi-0.162.0/README.mddocs/en/docs/img/favicon.pngfastapi-0.162.0/docs/en/docs/img/favicon.pngdocs_src/additional_responses/tutorial001_py310.pyfastapi-0.162.0/docs_src/additional_responses/tutorial001_py310.pydocs_src/additional_responses/tutorial002_py310.pyfastapi-0.162.0/docs_src/additional_responses/tutorial002_py310.pydocs_src/additional_responses/tutorial003_py310.pyfastapi-0.162.0/docs_src/additional_responses/tutorial003_py310.pydocs_src/additional_responses/tutorial004_py310.pyfastapi-0.162.0/docs_src/additional_responses/tutorial004_py310.pydocs_src/additional_status_codes/tutorial001_an_py310.pyfastapi-0.162.0/docs_src/additional_status_codes/tutorial001_an_py310.pydocs_src/additional_status_codes/tutorial001_py310.pyfastapi-0.162.0/docs_src/additional_status_codes/tutorial001_py310.pydocs_src/advanced_middleware/tutorial001_py310.pyfastapi-0.162.0/docs_src/advanced_middleware/tutorial001_py310.pydocs_src/advanced_middleware/tutorial002_py310.pyfastapi-0.162.0/docs_src/advanced_middleware/tutorial002_py310.pydocs_src/advanced_middleware/tutorial003_py310.pyfastapi-0.162.0/docs_src/advanced_middleware/tutorial003_py310.pydocs_src/app_testing/app_a_py310/main.pyfastapi-0.162.0/docs_src/app_testing/app_a_py310/main.pydocs_src/app_testing/app_a_py310/test_main.pyfastapi-0.162.0/docs_src/app_testing/app_a_py310/test_main.pydocs_src/app_testing/app_b_an_py310/main.pyfastapi-0.162.0/docs_src/app_testing/app_b_an_py310/main.pydocs_src/app_testing/app_b_an_py310/test_main.pyfastapi-0.162.0/docs_src/app_testing/app_b_an_py310/test_main.pydocs_src/app_testing/app_b_py310/main.pyfastapi-0.162.0/docs_src/app_testing/app_b_py310/main.pydocs_src/app_testing/app_b_py310/test_main.pyfastapi-0.162.0/docs_src/app_testing/app_b_py310/test_main.pydocs_src/app_testing/tutorial001_py310.pyfastapi-0.162.0/docs_src/app_testing/tutorial001_py310.pydocs_src/app_testing/tutorial002_py310.pyfastapi-0.162.0/docs_src/app_testing/tutorial002_py310.py

How ShadowCanopy checks PyPI packages

ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.

Protect your projects free See what's being blocked

Other PyPI packages

requests urllib3 flask django numpy pandas boto3 pytest pip setuptools python-dateutil pyyaml

This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/pypi/fastapi

fastapi — deep security report