All findings are false positives from heuristics matching benign patterns (function names containing 'eval', forward-ref comments, CPython URLs, test timestamps like 03:04:05, and example IPs in tests). The actual source is standard Pydantic schema-generation and type-handling code with no malicious behavior.
AI breakdown
Plain-English summary of what this package does and how it behaves.
Pydantic is a Python package for data validation using type hints. It includes core modules for models, fields, validators, JSON handling, and schema generation as shown in the file list.
Capabilities
- Provides Python library for data models and validation
Data access
- None observed
Network
- No network access observed
Standard library package with empty scripts and dependencies; static findings reference obfuscation and IPs but are not evidenced in the manifest or sampled files.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Security findings (16)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in pydantic/_internal/_generate_schema.py
Multiple obfuscation patterns in pydantic-2.13.4/pydantic/_internal/_generate_schema.py
Multiple obfuscation patterns in pydantic/_internal/_typing_extra.py
Multiple obfuscation patterns in pydantic-2.13.4/pydantic/_internal/_typing_extra.py
Multiple obfuscation patterns in tests/test_types.py
Multiple obfuscation patterns in pydantic-2.13.4/tests/test_types.py
File pydantic/functional_validators.py contains a hardcoded public IP (03:04:05) used in network code — review for hidden exfiltration or C2 endpoints.
File pydantic-2.13.4/pydantic/functional_validators.py contains a hardcoded public IP (03:04:05) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/test_datetime.py contains a hardcoded public IP (09:15:00) used in network code — review for hidden exfiltration or C2 endpoints.
File pydantic-2.13.4/tests/test_datetime.py contains a hardcoded public IP (09:15:00) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/test_json.py contains a hardcoded public IP (12:34:56) used in network code — review for hidden exfiltration or C2 endpoints.
File pydantic-2.13.4/tests/test_json.py contains a hardcoded public IP (12:34:56) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/test_networks.py contains a hardcoded public IP (123.45.67.8) used in network code — review for hidden exfiltration or C2 endpoints.
File pydantic-2.13.4/tests/test_networks.py contains a hardcoded public IP (123.45.67.8) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/test_types.py contains a hardcoded public IP (10:10:10) used in network code — review for hidden exfiltration or C2 endpoints.
File pydantic-2.13.4/tests/test_types.py contains a hardcoded public IP (10:10:10) used in network code — review for hidden exfiltration or C2 endpoints.
Package metadata
Data validation using Python type hints
Files in package (500)
How ShadowCanopy checks PyPI packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
Other PyPI packages
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/pypi/pydantic