All findings are false positives from crude pattern matching on a legitimate, widely-used JSON library. Escape sequences, Unicode literals, long comment blocks, module paths like de::/D::/f64::, and large numeric test cases are normal in a JSON parser; the source matches the real serde_json 1.0.151 with no malicious behavior.
AI breakdown
Plain-English summary of what this package does and how it behaves.
serde_json 1.0.151 is a Rust crate providing JSON serialization and deserialization, with source files under src/ including de.rs, lexical modules, and a build.rs.
Capabilities
- Contains Rust source for JSON parsing and lexical handling
- Includes build.rs
- No scripts defined in manifest
Data access
- None observed
Network
- Hardcoded public IP in network code (static findings)
Package appears to be the standard serde_json library; static findings report obfuscated files and hardcoded IPs but no supporting evidence in manifest or file list.
Security findings (12)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in src/de.rs
Multiple obfuscation patterns in serde_json-1.0.151/src/de.rs
Multiple obfuscation patterns in src/read.rs
Multiple obfuscation patterns in serde_json-1.0.151/src/read.rs
Multiple obfuscation patterns in tests/test.rs
Multiple obfuscation patterns in serde_json-1.0.151/tests/test.rs
File src/de.rs contains a hardcoded public IP (de::) used in network code — review for hidden exfiltration or C2 endpoints.
File serde_json-1.0.151/src/de.rs contains a hardcoded public IP (de::) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/regression/issue845.rs contains a hardcoded public IP (D::) used in network code — review for hidden exfiltration or C2 endpoints.
File serde_json-1.0.151/tests/regression/issue845.rs contains a hardcoded public IP (D::) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/test.rs contains a hardcoded public IP (f64::) used in network code — review for hidden exfiltration or C2 endpoints.
File serde_json-1.0.151/tests/test.rs contains a hardcoded public IP (f64::) used in network code — review for hidden exfiltration or C2 endpoints.
Files in package (178)
How ShadowCanopy checks crates.io packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/crates/serde_json