ShadowCanopy
Log inGet started

PyPI package intelligence

urllib3 — deep security report

ShadowCanopy's full breakdown of urllib3 on PyPI: verdict, AI analysis, dependency chain, network behavior, prebuilds, and obfuscated code.

Safe to use
Deep-scanned by ShadowCanopy — no threats found in its code, dependencies, or network behavior.
Scanned 7/28/2026
Approvedurllib3@2.7.0View on registry ↗latest: 2.7.0

urllib3 2.7.0 is the legitimate, widely-used HTTP client. All findings are false positives: base64 test payloads and null-byte test data in test_response.py, invalid-URL test cases in test_util.py, Pyodide/emscripten platform imports, and example IPs/fingerprints/RFC references used only in tests. No malicious behavior, exfiltration, or backdoors present.

Protect your projects free

AI breakdown

Plain-English summary of what this package does and how it behaves.

urllib3 is a Python HTTP library with thread-safe connection pooling, file post, and related features as described in the package manifest.

Capabilities

  • Dynamic module load with remote source
  • Obfuscated source file

Data access

  • None observed

Network

  • Makes outbound HTTP requests
  • Hardcoded public IP in network code

Static findings report multiple instances of obfuscated files, remote dynamic loads, and hardcoded IPs; no scripts or dependencies are present in the manifest.

Dependency & execution chain

Every package this one pulls in, colored by verdict. Expand to walk the tree.

6 packages4 direct
urllib3@2.7.040 findings
brotli@1.2.0
brotlicffi@1.2.0.1

Obfuscated / hidden code

Encoded payloads decoded statically (without executing them) so you can see what they resolve to.

Obfuscated source filetest/test_response.py

Multiple obfuscation patterns in test/test_response.py

Obfuscated source fileurllib3-2.7.0/test/test_response.py

Multiple obfuscation patterns in urllib3-2.7.0/test/test_response.py

Security findings (40)

Static analysis rule matches, with the exact code that triggered them.

mediumObfuscated source fileATK-023test/test_response.py

Multiple obfuscation patterns in test/test_response.py

mediumObfuscated source fileATK-023urllib3-2.7.0/test/test_response.py

Multiple obfuscation patterns in urllib3-2.7.0/test/test_response.py

mediumObfuscated source fileATK-023test/test_util.py

Multiple obfuscation patterns in test/test_util.py

mediumObfuscated source fileATK-023urllib3-2.7.0/test/test_util.py

Multiple obfuscation patterns in urllib3-2.7.0/test/test_util.py

highDynamic module load with remote sourceATK-027src/urllib3/poolmanager.py

File src/urllib3/poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027urllib3-2.7.0/src/urllib3/poolmanager.py

File urllib3-2.7.0/src/urllib3/poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027src/urllib3/contrib/emscripten/fetch.py

File src/urllib3/contrib/emscripten/fetch.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027urllib3-2.7.0/src/urllib3/contrib/emscripten/fetch.py

File urllib3-2.7.0/src/urllib3/contrib/emscripten/fetch.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027src/urllib3/util/retry.py

File src/urllib3/util/retry.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027urllib3-2.7.0/src/urllib3/util/retry.py

File urllib3-2.7.0/src/urllib3/util/retry.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highHardcoded public IP in network codeATK-028src/urllib3/util/url.py

File src/urllib3/util/url.py contains a hardcoded public IP (a::b) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/src/urllib3/util/url.py

File urllib3-2.7.0/src/urllib3/util/url.py contains a hardcoded public IP (a::b) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028test/test_compatibility.py

File test/test_compatibility.py contains a hardcoded public IP (18:49:35) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/test_compatibility.py

File urllib3-2.7.0/test/test_compatibility.py contains a hardcoded public IP (18:49:35) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028test/test_connection.py

File test/test_connection.py contains a hardcoded public IP (1.1.1.1) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/test_connection.py

File urllib3-2.7.0/test/test_connection.py contains a hardcoded public IP (1.1.1.1) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028test/test_connectionpool.py

File test/test_connectionpool.py contains a hardcoded public IP (2607:f8b0:4005:805) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/test_connectionpool.py

File urllib3-2.7.0/test/test_connectionpool.py contains a hardcoded public IP (2607:f8b0:4005:805) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028test/test_poolmanager.py

File test/test_poolmanager.py contains a hardcoded public IP (92:81:FE:85:F7:0C:26:60) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/test_poolmanager.py

File urllib3-2.7.0/test/test_poolmanager.py contains a hardcoded public IP (92:81:FE:85:F7:0C:26:60) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028test/test_retry.py

File test/test_retry.py contains a hardcoded public IP (7.1.1.1) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/test_retry.py

File urllib3-2.7.0/test/test_retry.py contains a hardcoded public IP (7.1.1.1) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028test/test_ssl.py

File test/test_ssl.py contains a hardcoded public IP (8.8.8.8) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/test_ssl.py

File urllib3-2.7.0/test/test_ssl.py contains a hardcoded public IP (8.8.8.8) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028test/test_util.py

File test/test_util.py contains a hardcoded public IP (173.194.35.7) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/test_util.py

File urllib3-2.7.0/test/test_util.py contains a hardcoded public IP (173.194.35.7) used in network code — review for hidden exfiltration or C2 endpoints.

highDynamic module load with remote sourceATK-027test/with_dummyserver/test_connectionpool.py

File test/with_dummyserver/test_connectionpool.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027urllib3-2.7.0/test/with_dummyserver/test_connectionpool.py

File urllib3-2.7.0/test/with_dummyserver/test_connectionpool.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highHardcoded public IP in network codeATK-028test/with_dummyserver/test_https.py

File test/with_dummyserver/test_https.py contains a hardcoded public IP (55:39:BF:70:05:12:43:FA) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/with_dummyserver/test_https.py

File urllib3-2.7.0/test/with_dummyserver/test_https.py contains a hardcoded public IP (55:39:BF:70:05:12:43:FA) used in network code — review for hidden exfiltration or C2 endpoints.

highDynamic module load with remote sourceATK-027test/with_dummyserver/test_poolmanager.py

File test/with_dummyserver/test_poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027urllib3-2.7.0/test/with_dummyserver/test_poolmanager.py

File urllib3-2.7.0/test/with_dummyserver/test_poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027test/with_dummyserver/test_proxy_poolmanager.py

File test/with_dummyserver/test_proxy_poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highHardcoded public IP in network codeATK-028test/with_dummyserver/test_proxy_poolmanager.py

File test/with_dummyserver/test_proxy_poolmanager.py contains a hardcoded public IP (0:0:0:0:0:0:0:1) used in network code — review for hidden exfiltration or C2 endpoints.

highDynamic module load with remote sourceATK-027urllib3-2.7.0/test/with_dummyserver/test_proxy_poolmanager.py

File urllib3-2.7.0/test/with_dummyserver/test_proxy_poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/with_dummyserver/test_proxy_poolmanager.py

File urllib3-2.7.0/test/with_dummyserver/test_proxy_poolmanager.py contains a hardcoded public IP (0:0:0:0:0:0:0:1) used in network code — review for hidden exfiltration or C2 endpoints.

highDynamic module load with remote sourceATK-027test/with_dummyserver/test_socketlevel.py

File test/with_dummyserver/test_socketlevel.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highHardcoded public IP in network codeATK-028test/with_dummyserver/test_socketlevel.py

File test/with_dummyserver/test_socketlevel.py contains a hardcoded public IP (2001:4998:c:a06) used in network code — review for hidden exfiltration or C2 endpoints.

highDynamic module load with remote sourceATK-027urllib3-2.7.0/test/with_dummyserver/test_socketlevel.py

File urllib3-2.7.0/test/with_dummyserver/test_socketlevel.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/with_dummyserver/test_socketlevel.py

File urllib3-2.7.0/test/with_dummyserver/test_socketlevel.py contains a hardcoded public IP (2001:4998:c:a06) used in network code — review for hidden exfiltration or C2 endpoints.

Package metadata

LicenseUnknown

HTTP library with thread-safe connection pooling, file post, and more.

Files in package (244)

CHANGES.rsturllib3-2.7.0/CHANGES.rstuv.lockurllib3-2.7.0/uv.lockdocs/Makefileurllib3-2.7.0/docs/Makefiledocs/advanced-usage.rsturllib3-2.7.0/docs/advanced-usage.rstdocs/changelog.rsturllib3-2.7.0/docs/changelog.rstdocs/conf.pyurllib3-2.7.0/docs/conf.pydocs/contributing.rsturllib3-2.7.0/docs/contributing.rstdocs/index.rsturllib3-2.7.0/docs/index.rstdocs/make.baturllib3-2.7.0/docs/make.batdocs/sponsors.rsturllib3-2.7.0/docs/sponsors.rstdocs/user-guide.rsturllib3-2.7.0/docs/user-guide.rstdocs/v2-migration-guide.rsturllib3-2.7.0/docs/v2-migration-guide.rstdocs/_static/banner.svgurllib3-2.7.0/docs/_static/banner.svgdocs/_static/banner_github.svgurllib3-2.7.0/docs/_static/banner_github.svgdocs/_static/dark-logo.svgurllib3-2.7.0/docs/_static/dark-logo.svgdocs/images/demo-button.pngurllib3-2.7.0/docs/images/demo-button.pngdocs/images/favicon.pngurllib3-2.7.0/docs/images/favicon.pngdocs/images/learn-more-button.pngurllib3-2.7.0/docs/images/learn-more-button.pngdocs/images/logo.pngurllib3-2.7.0/docs/images/logo.pngdocs/images/logo.svgurllib3-2.7.0/docs/images/logo.svg

How ShadowCanopy checks PyPI packages

ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.

Protect your projects freeSee what's being blocked

Other PyPI packages

requestsflaskdjangonumpypandasboto3pytestpipsetuptoolspython-dateutilpyyamlcryptography

This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/pypi/urllib3