urllib3 2.8.0 is the legitimate, widely-used HTTP client library. All flagged patterns (control-char regexes, GitHub commit comments, test IPs/fingerprints, conditional imports) are benign and match expected code for URL validation, CPython backports, and optional platform support. No malicious behavior present.
AI breakdown
Plain-English summary of what this package does and how it behaves.
urllib3 is a Python HTTP library providing thread-safe connection pooling, file POST support, and related HTTP client features.
Capabilities
- HTTP client functionality
- Thread-safe connection pooling
- File POST support
Data access
- None observed
Network
- Makes outbound HTTP requests
Static findings report multiple obfuscated source files, dynamic module loads with remote sources, and hardcoded public IPs; no scripts or dependencies are declared in the manifest.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Obfuscated / hidden code
Encoded payloads decoded statically (without executing them) so you can see what they resolve to.
Multiple obfuscation patterns in test/test_response.py
Multiple obfuscation patterns in urllib3-2.8.0/test/test_response.py
Security findings (44)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in src/urllib3/connection.py
Multiple obfuscation patterns in urllib3-2.8.0/src/urllib3/connection.py
Multiple obfuscation patterns in src/urllib3/util/url.py
Multiple obfuscation patterns in urllib3-2.8.0/src/urllib3/util/url.py
Multiple obfuscation patterns in test/test_response.py
Multiple obfuscation patterns in urllib3-2.8.0/test/test_response.py
Multiple obfuscation patterns in test/test_util.py
Multiple obfuscation patterns in urllib3-2.8.0/test/test_util.py
File src/urllib3/poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File urllib3-2.8.0/src/urllib3/poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File src/urllib3/contrib/emscripten/fetch.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File urllib3-2.8.0/src/urllib3/contrib/emscripten/fetch.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File src/urllib3/util/retry.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File urllib3-2.8.0/src/urllib3/util/retry.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File src/urllib3/util/url.py contains a hardcoded public IP (a::b) used in network code — review for hidden exfiltration or C2 endpoints.
File urllib3-2.8.0/src/urllib3/util/url.py contains a hardcoded public IP (a::b) used in network code — review for hidden exfiltration or C2 endpoints.
File test/test_compatibility.py contains a hardcoded public IP (18:49:35) used in network code — review for hidden exfiltration or C2 endpoints.
File urllib3-2.8.0/test/test_compatibility.py contains a hardcoded public IP (18:49:35) used in network code — review for hidden exfiltration or C2 endpoints.
File test/test_connection.py contains a hardcoded public IP (1.1.1.1) used in network code — review for hidden exfiltration or C2 endpoints.
File urllib3-2.8.0/test/test_connection.py contains a hardcoded public IP (1.1.1.1) used in network code — review for hidden exfiltration or C2 endpoints.
File test/test_connectionpool.py contains a hardcoded public IP (2607:f8b0:4005:805) used in network code — review for hidden exfiltration or C2 endpoints.
File urllib3-2.8.0/test/test_connectionpool.py contains a hardcoded public IP (2607:f8b0:4005:805) used in network code — review for hidden exfiltration or C2 endpoints.
File test/test_poolmanager.py contains a hardcoded public IP (92:81:FE:85:F7:0C:26:60) used in network code — review for hidden exfiltration or C2 endpoints.
File urllib3-2.8.0/test/test_poolmanager.py contains a hardcoded public IP (92:81:FE:85:F7:0C:26:60) used in network code — review for hidden exfiltration or C2 endpoints.
File test/test_retry.py contains a hardcoded public IP (7.1.1.1) used in network code — review for hidden exfiltration or C2 endpoints.
File urllib3-2.8.0/test/test_retry.py contains a hardcoded public IP (7.1.1.1) used in network code — review for hidden exfiltration or C2 endpoints.
File test/test_ssl.py contains a hardcoded public IP (8.8.8.8) used in network code — review for hidden exfiltration or C2 endpoints.
File urllib3-2.8.0/test/test_ssl.py contains a hardcoded public IP (8.8.8.8) used in network code — review for hidden exfiltration or C2 endpoints.
File test/test_util.py contains a hardcoded public IP (173.194.35.7) used in network code — review for hidden exfiltration or C2 endpoints.
File urllib3-2.8.0/test/test_util.py contains a hardcoded public IP (173.194.35.7) used in network code — review for hidden exfiltration or C2 endpoints.
File test/with_dummyserver/test_connectionpool.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File urllib3-2.8.0/test/with_dummyserver/test_connectionpool.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File test/with_dummyserver/test_https.py contains a hardcoded public IP (55:39:BF:70:05:12:43:FA) used in network code — review for hidden exfiltration or C2 endpoints.
File urllib3-2.8.0/test/with_dummyserver/test_https.py contains a hardcoded public IP (55:39:BF:70:05:12:43:FA) used in network code — review for hidden exfiltration or C2 endpoints.
File test/with_dummyserver/test_poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File urllib3-2.8.0/test/with_dummyserver/test_poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File test/with_dummyserver/test_proxy_poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File test/with_dummyserver/test_proxy_poolmanager.py contains a hardcoded public IP (0:0:0:0:0:0:0:1) used in network code — review for hidden exfiltration or C2 endpoints.
File urllib3-2.8.0/test/with_dummyserver/test_proxy_poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File urllib3-2.8.0/test/with_dummyserver/test_proxy_poolmanager.py contains a hardcoded public IP (0:0:0:0:0:0:0:1) used in network code — review for hidden exfiltration or C2 endpoints.
File test/with_dummyserver/test_socketlevel.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File test/with_dummyserver/test_socketlevel.py contains a hardcoded public IP (2001:4998:c:a06) used in network code — review for hidden exfiltration or C2 endpoints.
File urllib3-2.8.0/test/with_dummyserver/test_socketlevel.py builds a dynamic import/require argument alongside network access — possible remote module loading.
File urllib3-2.8.0/test/with_dummyserver/test_socketlevel.py contains a hardcoded public IP (2001:4998:c:a06) used in network code — review for hidden exfiltration or C2 endpoints.
Package metadata
HTTP library with thread-safe connection pooling, file post, and more.
Files in package (248)
How ShadowCanopy checks PyPI packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
Other PyPI packages
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/pypi/urllib3