All findings are false positives from heuristics matching benign patterns (function names containing 'eval', test data with timestamps/IPs/hex escapes, and test code using cloudpickle). The actual source is legitimate Pydantic validation/JSON schema logic with no malicious behavior.
AI breakdown
Plain-English summary of what this package does and how it behaves.
pydantic is a Python package for data validation using type hints, with core modules for models, fields, parsing, and schema handling.
Capabilities
- Defines data models with type hints
- Generates JSON schemas
- Parses and validates various data types
- Supports environment variable settings
Data access
- Environment variables
Network
- Network address and URL validation
Static analysis flagged multiple instances of obfuscated files, decoded payloads, and hardcoded public IPs; however the manifest and file list match the legitimate pydantic library with no scripts or dependencies.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Security findings (20)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in pydantic/json_schema.py
Multiple obfuscation patterns in pydantic-2.14.2/pydantic/json_schema.py
Multiple obfuscation patterns in pydantic/_internal/_generate_schema.py
Multiple obfuscation patterns in pydantic-2.14.2/pydantic/_internal/_generate_schema.py
Multiple obfuscation patterns in tests/test_types.py
Multiple obfuscation patterns in pydantic-2.14.2/tests/test_types.py
File pydantic/functional_validators.py contains a hardcoded public IP (03:04:05) used in network code — review for hidden exfiltration or C2 endpoints.
File pydantic-2.14.2/pydantic/functional_validators.py contains a hardcoded public IP (03:04:05) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/test_datetime.py contains a hardcoded public IP (09:15:00) used in network code — review for hidden exfiltration or C2 endpoints.
File pydantic-2.14.2/tests/test_datetime.py contains a hardcoded public IP (09:15:00) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/test_generics.py decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File pydantic-2.14.2/tests/test_generics.py decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File tests/test_json.py contains a hardcoded public IP (12:34:56) used in network code — review for hidden exfiltration or C2 endpoints.
File pydantic-2.14.2/tests/test_json.py contains a hardcoded public IP (12:34:56) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/test_networks.py contains a hardcoded public IP (123.45.67.8) used in network code — review for hidden exfiltration or C2 endpoints.
File pydantic-2.14.2/tests/test_networks.py contains a hardcoded public IP (123.45.67.8) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/types/test_datetime.py contains a hardcoded public IP (10:10:10) used in network code — review for hidden exfiltration or C2 endpoints.
File pydantic-2.14.2/tests/types/test_datetime.py contains a hardcoded public IP (10:10:10) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/types/test_time.py contains a hardcoded public IP (10:10:10) used in network code — review for hidden exfiltration or C2 endpoints.
File pydantic-2.14.2/tests/types/test_time.py contains a hardcoded public IP (10:10:10) used in network code — review for hidden exfiltration or C2 endpoints.
Package metadata
Data validation using Python type hints
Files in package (500)
How ShadowCanopy checks PyPI packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
Other PyPI packages
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/pypi/pydantic