This is the legitimate, well-known 'requests' HTTP library (v2.34.2). All findings are false positives from heuristics misfiring on normal code: hex escapes and base64 in tests, URI character sets, optional cryptography import, cookie expiration strings, and test IPs like 8.8.8.8. No malicious behavior present.
AI breakdown
Plain-English summary of what this package does and how it behaves.
The requests package is a Python HTTP library described as 'Python HTTP for Humans.' It provides modules for sending HTTP requests, managing sessions, authentication, cookies, and related utilities.
Capabilities
- Makes HTTP requests
- Manages sessions and cookies
- Supports authentication methods
- Handles response models and status codes
Data access
- Filesystem (certs.py and related files)
- Environment variables
Network
- Makes outbound HTTP requests
Static findings flag multiple instances of obfuscated source files, dynamic module loads with remote sources, and hardcoded public IPs. The manifest shows no scripts or dependencies and the package is a well-known HTTP client.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Security findings (16)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in src/requests/utils.py
Multiple obfuscation patterns in requests-2.34.2/src/requests/utils.py
Multiple obfuscation patterns in tests/test_requests.py
Multiple obfuscation patterns in requests-2.34.2/tests/test_requests.py
Multiple obfuscation patterns in tests/test_utils.py
Multiple obfuscation patterns in requests-2.34.2/tests/test_utils.py
File src/requests/__init__.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File requests-2.34.2/src/requests/__init__.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File src/requests/models.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File requests-2.34.2/src/requests/models.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File tests/test_requests.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File tests/test_requests.py contains a hardcoded public IP (00:00:01) used in network code — review for hidden exfiltration or C2 endpoints.
File requests-2.34.2/tests/test_requests.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File requests-2.34.2/tests/test_requests.py contains a hardcoded public IP (00:00:01) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/test_utils.py contains a hardcoded public IP (8.8.8.8) used in network code — review for hidden exfiltration or C2 endpoints.
File requests-2.34.2/tests/test_utils.py contains a hardcoded public IP (8.8.8.8) used in network code — review for hidden exfiltration or C2 endpoints.
Package metadata
Python HTTP for Humans.
Files in package (166)
How ShadowCanopy checks PyPI packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
Other PyPI packages
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/pypi/requests