Is fastapi (PyPI) safe to install?

fastapi matches a known-malicious advisory (MAL-2026-4750) in ShadowCanopy's live threat intelligence and is blocked by default across every project.

fastapi is flagged malicious (PyPI) — ShadowCanopy

Dangerous — known malicious

This package matches a known-malicious advisory and is blocked by ShadowCanopy by default.

Scanned 8/16/2026

Known maliciousfastapi@0.141.1View on registry ↗latest: 0.141.1

This package matches a known-malicious advisory (MAL-2026-4750) and is blocked by ShadowCanopy by default across every project. 1 flagged version.

20 heuristic finding(s) in fastapi@0.141.1 — review recommended (AI second opinion unavailable).

Protect your projects free

AI breakdown

Plain-English summary of what this package does and how it behaves.

FastAPI framework, high performance, easy to learn, fast to code, ready for production

Capabilities

Spawns child processes
Contains obfuscated/encoded code

Data access

None observed in static analysis

Network

Makes outbound network requests

Static analysis raised 20 finding(s). Review the details below before installing.

Dependency & execution chain

Every package this one pulls in, colored by verdict. Expand to walk the tree.

13 packages6 direct2 flagged

fastapi@0.141.1Flagged20 findings

starlette@1.6.0Flagged10 findings

pydantic@2.13.516 findings

typing-extensions@4.16.04 findings

typing-inspection@0.4.4

annotated-doc@0.0.5

Security findings (20)

Static analysis rule matches, with the exact code that triggered them.

mediumObfuscated source fileATK-023tests/test_sse.py

Multiple obfuscation patterns in tests/test_sse.py

mediumObfuscated source fileATK-023fastapi-0.141.1/tests/test_sse.py

Multiple obfuscation patterns in fastapi-0.141.1/tests/test_sse.py

highRemote fetch with process executionATK-024scripts/playwright/cookie_param_models/image01.py

File scripts/playwright/cookie_param_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.141.1/scripts/playwright/cookie_param_models/image01.py

File fastapi-0.141.1/scripts/playwright/cookie_param_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024scripts/playwright/header_param_models/image01.py

File scripts/playwright/header_param_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.141.1/scripts/playwright/header_param_models/image01.py

File fastapi-0.141.1/scripts/playwright/header_param_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024scripts/playwright/json_base64_bytes/image01.py

File scripts/playwright/json_base64_bytes/image01.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.141.1/scripts/playwright/json_base64_bytes/image01.py

File fastapi-0.141.1/scripts/playwright/json_base64_bytes/image01.py combines network access with process execution

highRemote fetch with process executionATK-024scripts/playwright/query_param_models/image01.py

File scripts/playwright/query_param_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.141.1/scripts/playwright/query_param_models/image01.py

File fastapi-0.141.1/scripts/playwright/query_param_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024scripts/playwright/request_form_models/image01.py

File scripts/playwright/request_form_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.141.1/scripts/playwright/request_form_models/image01.py

File fastapi-0.141.1/scripts/playwright/request_form_models/image01.py combines network access with process execution

highRemote fetch with process executionATK-024scripts/playwright/sql_databases/image01.py

File scripts/playwright/sql_databases/image01.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.141.1/scripts/playwright/sql_databases/image01.py

File fastapi-0.141.1/scripts/playwright/sql_databases/image01.py combines network access with process execution

highRemote fetch with process executionATK-024scripts/playwright/sql_databases/image02.py

File scripts/playwright/sql_databases/image02.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.141.1/scripts/playwright/sql_databases/image02.py

File fastapi-0.141.1/scripts/playwright/sql_databases/image02.py combines network access with process execution

highRemote fetch with process executionATK-024scripts/sponsors.py

File scripts/sponsors.py combines network access with process execution

highRemote fetch with process executionATK-024fastapi-0.141.1/scripts/sponsors.py

File fastapi-0.141.1/scripts/sponsors.py combines network access with process execution

highHardcoded public IP in network codeATK-028tests/test_tutorial/test_extra_data_types/test_tutorial001.py

File tests/test_tutorial/test_extra_data_types/test_tutorial001.py contains a hardcoded public IP (15:30:00) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028fastapi-0.141.1/tests/test_tutorial/test_extra_data_types/test_tutorial001.py

File fastapi-0.141.1/tests/test_tutorial/test_extra_data_types/test_tutorial001.py contains a hardcoded public IP (15:30:00) used in network code — review for hidden exfiltration or C2 endpoints.

Package metadata

LicenseUnknown

FastAPI framework, high performance, easy to learn, fast to code, ready for production

Files in package (500)

LICENSEfastapi-0.141.1/LICENSEREADME.mdfastapi-0.141.1/README.mddocs/en/docs/img/favicon.pngfastapi-0.141.1/docs/en/docs/img/favicon.pngdocs_src/additional_responses/tutorial001_py310.pyfastapi-0.141.1/docs_src/additional_responses/tutorial001_py310.pydocs_src/additional_responses/tutorial002_py310.pyfastapi-0.141.1/docs_src/additional_responses/tutorial002_py310.pydocs_src/additional_responses/tutorial003_py310.pyfastapi-0.141.1/docs_src/additional_responses/tutorial003_py310.pydocs_src/additional_responses/tutorial004_py310.pyfastapi-0.141.1/docs_src/additional_responses/tutorial004_py310.pydocs_src/additional_status_codes/tutorial001_an_py310.pyfastapi-0.141.1/docs_src/additional_status_codes/tutorial001_an_py310.pydocs_src/additional_status_codes/tutorial001_py310.pyfastapi-0.141.1/docs_src/additional_status_codes/tutorial001_py310.pydocs_src/advanced_middleware/tutorial001_py310.pyfastapi-0.141.1/docs_src/advanced_middleware/tutorial001_py310.pydocs_src/advanced_middleware/tutorial002_py310.pyfastapi-0.141.1/docs_src/advanced_middleware/tutorial002_py310.pydocs_src/advanced_middleware/tutorial003_py310.pyfastapi-0.141.1/docs_src/advanced_middleware/tutorial003_py310.pydocs_src/app_testing/app_a_py310/main.pyfastapi-0.141.1/docs_src/app_testing/app_a_py310/main.pydocs_src/app_testing/app_a_py310/test_main.pyfastapi-0.141.1/docs_src/app_testing/app_a_py310/test_main.pydocs_src/app_testing/app_b_an_py310/main.pyfastapi-0.141.1/docs_src/app_testing/app_b_an_py310/main.pydocs_src/app_testing/app_b_an_py310/test_main.pyfastapi-0.141.1/docs_src/app_testing/app_b_an_py310/test_main.pydocs_src/app_testing/app_b_py310/main.pyfastapi-0.141.1/docs_src/app_testing/app_b_py310/main.pydocs_src/app_testing/app_b_py310/test_main.pyfastapi-0.141.1/docs_src/app_testing/app_b_py310/test_main.pydocs_src/app_testing/tutorial001_py310.pyfastapi-0.141.1/docs_src/app_testing/tutorial001_py310.pydocs_src/app_testing/tutorial002_py310.pyfastapi-0.141.1/docs_src/app_testing/tutorial002_py310.py

How ShadowCanopy checks PyPI packages

ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.

Protect your projects free See what's being blocked

Other PyPI packages

requests urllib3 flask django numpy pandas boto3 pytest pip setuptools python-dateutil pyyaml

This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/pypi/fastapi

fastapi — deep security report