All findings are false positives from crude heuristics. The '\x00', '\uDEAD', long slash comments, escape sequences, and 'de::'/'D::'/'f64::' matches are normal Rust source and JSON escape/number handling in the real serde_json crate. No credential theft, exfiltration, remote execution, or any other malicious behavior exists in the provided source.
AI breakdown
Plain-English summary of what this package does and how it behaves.
serde_json 1.0.154 is the source distribution of a widely used Rust crate that provides JSON serialization and deserialization.
Capabilities
- JSON serialization and deserialization
- Lexical parsing for numbers
- Runs build.rs at compile time
Data access
- Filesystem (via Cargo build)
Network
- No network access observed
Static findings report obfuscated files and hardcoded IPs, but the provided sources are standard Rust library files with no evident malicious behavior; review recommended before use in sensitive environments.
Security findings (12)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in src/de.rs
Multiple obfuscation patterns in serde_json-1.0.154/src/de.rs
Multiple obfuscation patterns in src/read.rs
Multiple obfuscation patterns in serde_json-1.0.154/src/read.rs
Multiple obfuscation patterns in tests/test.rs
Multiple obfuscation patterns in serde_json-1.0.154/tests/test.rs
File src/de.rs contains a hardcoded public IP (de::) used in network code — review for hidden exfiltration or C2 endpoints.
File serde_json-1.0.154/src/de.rs contains a hardcoded public IP (de::) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/regression/issue845.rs contains a hardcoded public IP (D::) used in network code — review for hidden exfiltration or C2 endpoints.
File serde_json-1.0.154/tests/regression/issue845.rs contains a hardcoded public IP (D::) used in network code — review for hidden exfiltration or C2 endpoints.
File tests/test.rs contains a hardcoded public IP (f64::) used in network code — review for hidden exfiltration or C2 endpoints.
File serde_json-1.0.154/tests/test.rs contains a hardcoded public IP (f64::) used in network code — review for hidden exfiltration or C2 endpoints.
Files in package (180)
How ShadowCanopy checks crates.io packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/crates/serde_json