This is the legitimate, well-known 'requests' HTTP library (v2.32.3) with zero static findings and only standard package files present. No malicious behavior indicated.
AI breakdown
Plain-English summary of what this package does and how it behaves.
The 'requests' package is a Python HTTP library described as 'Python HTTP for Humans.' It provides modules for making HTTP requests, handling sessions, authentication, cookies, and related utilities.
Capabilities
- Makes HTTP requests
- Manages sessions and cookies
- Handles authentication
- Provides status codes and exceptions
Data access
- Filesystem (certs.py present)
- Environment variables (not observed in manifest)
Network
- Makes outbound HTTP requests
Widely used benign library with no scripts or dependencies in manifest and no static findings; standard HTTP client behavior expected.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Known vulnerabilities (4)
Published CVEs / advisories affecting this version.
Requests vulnerable to .netrc credentials leak via malicious URLs
Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
Requests vulnerable to .netrc credentials leak via malicious URLs
Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded i
Files in package (166)
How ShadowCanopy checks PyPI packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
Other PyPI packages
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/pypi/requests