All findings are false positives from vendored docs/tests (MathJax JS with unicode/eval for i18n+dynamic loading, Meson build scripts, archived reference URLs in comments, slice notation/timestamps misread as IPs, and hex escapes in NumPy test data/docstrings). No malicious behavior in NumPy source itself.
AI breakdown
Plain-English summary of what this package does and how it behaves.
numpy 2.5.1 is the fundamental package for array computing in Python. The manifest lists no scripts or dependencies.
Data access
- None observed
Network
- No network access observed
Standard scientific computing library with extensive CI configuration files; static findings list metadata, URL, obfuscation and IP issues but no direct evidence in manifest or sampled files.
Obfuscated / hidden code
Encoded payloads decoded statically (without executing them) so you can see what they resolve to.
Multiple obfuscation patterns in doc/source/_static/scipy-mathjax/MathJax.js
Multiple obfuscation patterns in numpy-2.5.1/doc/source/_static/scipy-mathjax/MathJax.js
Multiple obfuscation patterns in doc/source/_static/scipy-mathjax/extensions/a11y/mathjax-sre.js
Multiple obfuscation patterns in numpy-2.5.1/doc/source/_static/scipy-mathjax/extensions/a11y/mathjax-sre.js
Multiple obfuscation patterns in numpy/_core/src/common/pythoncapi-compat/tests/test_pythoncapi_compat_cext.c
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/src/common/pythoncapi-compat/tests/test_pythoncapi_compat_cext.c
Multiple obfuscation patterns in numpy/_core/tests/test_arrayprint.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/tests/test_arrayprint.py
Multiple obfuscation patterns in numpy/_core/tests/test_defchararray.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/tests/test_defchararray.py
Multiple obfuscation patterns in numpy/_core/tests/test_multiarray.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/tests/test_multiarray.py
Multiple obfuscation patterns in numpy/_core/tests/test_regression.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/tests/test_regression.py
Multiple obfuscation patterns in numpy/lib/tests/test_format.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/lib/tests/test_format.py
Multiple obfuscation patterns in numpy/lib/tests/test_io.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/lib/tests/test_io.py
Multiple obfuscation patterns in numpy/random/tests/test_generator_mt19937.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/random/tests/test_generator_mt19937.py
Multiple obfuscation patterns in vendored-meson/meson/test cases/unit/111 replace unencodable xml chars/script.py
Multiple obfuscation patterns in numpy-2.5.1/vendored-meson/meson/test cases/unit/111 replace unencodable xml chars/script.py
Multiple obfuscation patterns in vendored-meson/meson/unittests/allplatformstests.py
Multiple obfuscation patterns in numpy-2.5.1/vendored-meson/meson/unittests/allplatformstests.py
Security findings (124)
Static analysis rule matches, with the exact code that triggered them.
Version mismatch in doc/source/_static/scipy-mathjax/package.json
URLhaus: 2026-08-06 13:20:12: https://web.archive.org/web/20140822061353/http://cens.ioc.ee/projects/f2py2e (urlhaus)
URLhaus: 2026-08-06 13:20:12: https://web.archive.org/web/20080221202153/https://www.math.hmc.edu/~benjamin/papers/CombTrig.pdf (urlhaus)
URLhaus: 2026-08-06 13:20:12: http://web.archive.org/web/20190715081007/http://voices.canonical.com/jussi.pakkanen/2013/04/16/why-you-should-consider-using-separate-build-directories/ (urlhaus)
Multiple obfuscation patterns in doc/source/_static/scipy-mathjax/MathJax.js
Multiple obfuscation patterns in numpy-2.5.1/doc/source/_static/scipy-mathjax/MathJax.js
Multiple obfuscation patterns in doc/source/_static/scipy-mathjax/extensions/a11y/mathjax-sre.js
Multiple obfuscation patterns in numpy-2.5.1/doc/source/_static/scipy-mathjax/extensions/a11y/mathjax-sre.js
Multiple obfuscation patterns in doc/source/_static/scipy-mathjax/jax/element/mml/jax.js
Multiple obfuscation patterns in numpy-2.5.1/doc/source/_static/scipy-mathjax/jax/element/mml/jax.js
Multiple obfuscation patterns in doc/source/_static/scipy-mathjax/jax/input/TeX/jax.js
Multiple obfuscation patterns in numpy-2.5.1/doc/source/_static/scipy-mathjax/jax/input/TeX/jax.js
Multiple obfuscation patterns in doc/source/_static/scipy-mathjax/jax/output/CommonHTML/autoload/mglyph.js
Multiple obfuscation patterns in numpy-2.5.1/doc/source/_static/scipy-mathjax/jax/output/CommonHTML/autoload/mglyph.js
Multiple obfuscation patterns in doc/source/_static/scipy-mathjax/jax/output/CommonHTML/autoload/ms.js
Multiple obfuscation patterns in numpy-2.5.1/doc/source/_static/scipy-mathjax/jax/output/CommonHTML/autoload/ms.js
Multiple obfuscation patterns in doc/source/_static/scipy-mathjax/jax/output/CommonHTML/fonts/TeX/fontdata.js
Multiple obfuscation patterns in numpy-2.5.1/doc/source/_static/scipy-mathjax/jax/output/CommonHTML/fonts/TeX/fontdata.js
Multiple obfuscation patterns in doc/source/_static/scipy-mathjax/jax/output/CommonHTML/jax.js
Multiple obfuscation patterns in numpy-2.5.1/doc/source/_static/scipy-mathjax/jax/output/CommonHTML/jax.js
Multiple obfuscation patterns in doc/source/_static/scipy-mathjax/jax/output/SVG/fonts/TeX/fontdata.js
Multiple obfuscation patterns in numpy-2.5.1/doc/source/_static/scipy-mathjax/jax/output/SVG/fonts/TeX/fontdata.js
Multiple obfuscation patterns in doc/source/_static/scipy-mathjax/jax/output/SVG/jax.js
Multiple obfuscation patterns in numpy-2.5.1/doc/source/_static/scipy-mathjax/jax/output/SVG/jax.js
Multiple obfuscation patterns in numpy/_core/code_generators/ufunc_docstrings.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/code_generators/ufunc_docstrings.py
Multiple obfuscation patterns in numpy/_core/src/common/pythoncapi-compat/tests/test_pythoncapi_compat_cext.c
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/src/common/pythoncapi-compat/tests/test_pythoncapi_compat_cext.c
Multiple obfuscation patterns in numpy/_core/src/npymath/ieee754.cpp
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/src/npymath/ieee754.cpp
Multiple obfuscation patterns in numpy/_core/tests/test_arrayprint.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/tests/test_arrayprint.py
Multiple obfuscation patterns in numpy/_core/tests/test_defchararray.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/tests/test_defchararray.py
Multiple obfuscation patterns in numpy/_core/tests/test_dtype.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/tests/test_dtype.py
Multiple obfuscation patterns in numpy/_core/tests/test_multiarray.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/tests/test_multiarray.py
Multiple obfuscation patterns in numpy/_core/tests/test_regression.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/tests/test_regression.py
Multiple obfuscation patterns in numpy/_core/tests/test_scalarbuffer.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/tests/test_scalarbuffer.py
Multiple obfuscation patterns in numpy/_core/tests/test_strings.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/tests/test_strings.py
Multiple obfuscation patterns in numpy/_core/tests/test_umath.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/_core/tests/test_umath.py
Multiple obfuscation patterns in numpy/f2py/crackfortran.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/f2py/crackfortran.py
Multiple obfuscation patterns in numpy/lib/_format_impl.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/lib/_format_impl.py
Multiple obfuscation patterns in numpy/lib/_npyio_impl.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/lib/_npyio_impl.py
Multiple obfuscation patterns in numpy/lib/tests/test_format.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/lib/tests/test_format.py
Multiple obfuscation patterns in numpy/lib/tests/test_io.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/lib/tests/test_io.py
Multiple obfuscation patterns in numpy/random/tests/test_generator_mt19937.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/random/tests/test_generator_mt19937.py
Multiple obfuscation patterns in numpy/random/tests/test_random.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/random/tests/test_random.py
Multiple obfuscation patterns in numpy/random/tests/test_randomstate.py
Multiple obfuscation patterns in numpy-2.5.1/numpy/random/tests/test_randomstate.py
Multiple obfuscation patterns in vendored-meson/meson/mesonbuild/mtest.py
Multiple obfuscation patterns in numpy-2.5.1/vendored-meson/meson/mesonbuild/mtest.py
Multiple obfuscation patterns in vendored-meson/meson/mesonbuild/utils/universal.py
Multiple obfuscation patterns in numpy-2.5.1/vendored-meson/meson/mesonbuild/utils/universal.py
Multiple obfuscation patterns in vendored-meson/meson/run_mypy.py
Multiple obfuscation patterns in numpy-2.5.1/vendored-meson/meson/run_mypy.py
Multiple obfuscation patterns in vendored-meson/meson/test cases/unit/111 replace unencodable xml chars/script.py
Multiple obfuscation patterns in numpy-2.5.1/vendored-meson/meson/test cases/unit/111 replace unencodable xml chars/script.py
Multiple obfuscation patterns in vendored-meson/meson/unittests/allplatformstests.py
Multiple obfuscation patterns in numpy-2.5.1/vendored-meson/meson/unittests/allplatformstests.py
File doc/neps/conf.py contains a hardcoded public IP (12:45:09) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/doc/neps/conf.py contains a hardcoded public IP (12:45:09) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/_add_newdocs.py contains a hardcoded public IP (1::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/_add_newdocs.py contains a hardcoded public IP (1::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/arrayprint.py contains a hardcoded public IP (13:58:44) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/arrayprint.py contains a hardcoded public IP (13:58:44) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/multiarray.py contains a hardcoded public IP (1::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/multiarray.py contains a hardcoded public IP (1::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/src/common/mem_overlap.c contains a hardcoded public IP (1::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/src/common/mem_overlap.c contains a hardcoded public IP (1::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/src/multiarray/datetime_strings.c contains a hardcoded public IP (24:00:00) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/src/multiarray/datetime_strings.c contains a hardcoded public IP (24:00:00) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/tests/test_datetime.py contains a hardcoded public IP (00:00:00) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/tests/test_datetime.py contains a hardcoded public IP (00:00:00) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/tests/test_dtype.py contains a hardcoded public IP (1::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/tests/test_dtype.py contains a hardcoded public IP (1::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/tests/test_indexing.py contains a hardcoded public IP (0::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/tests/test_indexing.py contains a hardcoded public IP (0::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/tests/test_mem_overlap.py contains a hardcoded public IP (3::3) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/tests/test_mem_overlap.py contains a hardcoded public IP (3::3) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/tests/test_multiarray.py contains a hardcoded public IP (1::) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/tests/test_multiarray.py contains a hardcoded public IP (1::) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/tests/test_nditer.py contains a hardcoded public IP (1::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/tests/test_nditer.py contains a hardcoded public IP (1::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/tests/test_numeric.py contains a hardcoded public IP (1::3) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/tests/test_numeric.py contains a hardcoded public IP (1::3) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/tests/test_regression.py contains a hardcoded public IP (12:09:09) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/tests/test_regression.py contains a hardcoded public IP (12:09:09) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/tests/test_simd.py contains a hardcoded public IP (0::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/tests/test_simd.py contains a hardcoded public IP (0::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/tests/test_stringdtype.py contains a hardcoded public IP (1::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/tests/test_stringdtype.py contains a hardcoded public IP (1::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/tests/test_ufunc.py contains a hardcoded public IP (1::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/tests/test_ufunc.py contains a hardcoded public IP (1::2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/_core/tests/test_umath.py contains a hardcoded public IP (1::3) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/_core/tests/test_umath.py contains a hardcoded public IP (1::3) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/f2py/crackfortran.py contains a hardcoded public IP (3.3.2.4) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/f2py/crackfortran.py contains a hardcoded public IP (3.3.2.4) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/f2py/src/fortranobject.c contains a hardcoded public IP (07:44:20) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/f2py/src/fortranobject.c contains a hardcoded public IP (07:44:20) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/lib/tests/test_index_tricks.py contains a hardcoded public IP (1:1:0) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/lib/tests/test_index_tricks.py contains a hardcoded public IP (1:1:0) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/ma/tests/test_old_ma.py contains a hardcoded public IP (4:10:2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/ma/tests/test_old_ma.py contains a hardcoded public IP (4:10:2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/random/src/mt19937/randomkit.c contains a hardcoded public IP (22:14:09) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/random/src/mt19937/randomkit.c contains a hardcoded public IP (22:14:09) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/random/src/mt19937/randomkit.h contains a hardcoded public IP (22:14:09) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/random/src/mt19937/randomkit.h contains a hardcoded public IP (22:14:09) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy/typing/tests/data/pass/index_tricks.py contains a hardcoded public IP (1:1:2) used in network code — review for hidden exfiltration or C2 endpoints.
File numpy-2.5.1/numpy/typing/tests/data/pass/index_tricks.py contains a hardcoded public IP (1:1:2) used in network code — review for hidden exfiltration or C2 endpoints.
File vendored-meson/meson/mesonbuild/utils/universal.py combines network access with process execution
File numpy-2.5.1/vendored-meson/meson/mesonbuild/utils/universal.py combines network access with process execution
Package metadata
Fundamental package for array computing in Python
Files in package (500)
How ShadowCanopy checks PyPI packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
Other PyPI packages
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/pypi/numpy