The flagged file is Flask's own legitimate test_json.py. The byte patterns (deadbeef UUID, snowman unicode, and a datetime string) are ordinary test data, not obfuscation or exfiltration. No malicious behavior present.
AI breakdown
Plain-English summary of what this package does and how it behaves.
Flask is a PyPI package described as a simple framework for building complex web applications. The sample files consist entirely of documentation, license, changelog, and related assets with no application source shown.
Capabilities
- No scripts defined in manifest
- Includes documentation for web app development and deployment
Data access
- None observed
Network
- Hardcoded public IP in network code (per static findings)
Static findings flag obfuscated files and hardcoded IPs, though the manifest and sampled files show only standard documentation for the well-known Flask framework.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Security findings (4)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in tests/test_json.py
Multiple obfuscation patterns in flask-3.1.3/tests/test_json.py
File tests/test_json.py contains a hardcoded public IP (07:15:00) used in network code — review for hidden exfiltration or C2 endpoints.
File flask-3.1.3/tests/test_json.py contains a hardcoded public IP (07:15:00) used in network code — review for hidden exfiltration or C2 endpoints.
Package metadata
A simple framework for building complex web applications.
Files in package (436)
How ShadowCanopy checks PyPI packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
Other PyPI packages
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/pypi/flask