Is urllib3 (PyPI) safe to install?

Is urllib3 safe? PyPI package security — ShadowCanopy

Safe to use

Deep-scanned by ShadowCanopy — no threats found in its code, dependencies, or network behavior.

Scanned 8/11/2026

Approvedurllib3@2.7.0View on registry ↗latest: 2.7.0

urllib3 2.7.0 is the legitimate, widely-used HTTP client library. All findings are false positives from test data (base64 zlib payloads, example IPs/IPv6 literals, invalid-URL test cases) and normal imports (including optional pyodide/emscripten support). No malicious behavior, exfiltration, or backdoors present in the source.

Protect your projects free

AI breakdown

Plain-English summary of what this package does and how it behaves.

urllib3 is a Python HTTP library providing thread-safe connection pooling, file post, and related functionality.

Data access

None observed

Network

Makes outbound HTTP requests

Widely used HTTP client library with no scripts or dependencies in manifest. Multiple static findings for obfuscated files, dynamic remote module loads, and hardcoded public IPs warrant manual review of source.

Dependency & execution chain

Every package this one pulls in, colored by verdict. Expand to walk the tree.

6 packages4 direct

urllib3@2.7.040 findings

brotli@1.2.0

brotlicffi@1.2.0.1

backports-zstd@1.7.0

Obfuscated / hidden code

Encoded payloads decoded statically (without executing them) so you can see what they resolve to.

Obfuscated source filetest/test_response.py

Multiple obfuscation patterns in test/test_response.py

Obfuscated source fileurllib3-2.7.0/test/test_response.py

Multiple obfuscation patterns in urllib3-2.7.0/test/test_response.py

Security findings (40)

Static analysis rule matches, with the exact code that triggered them.

mediumObfuscated source fileATK-023test/test_response.py

Multiple obfuscation patterns in test/test_response.py

mediumObfuscated source fileATK-023urllib3-2.7.0/test/test_response.py

Multiple obfuscation patterns in urllib3-2.7.0/test/test_response.py

mediumObfuscated source fileATK-023test/test_util.py

Multiple obfuscation patterns in test/test_util.py

mediumObfuscated source fileATK-023urllib3-2.7.0/test/test_util.py

Multiple obfuscation patterns in urllib3-2.7.0/test/test_util.py

highDynamic module load with remote sourceATK-027src/urllib3/poolmanager.py

File src/urllib3/poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027urllib3-2.7.0/src/urllib3/poolmanager.py

File urllib3-2.7.0/src/urllib3/poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027src/urllib3/contrib/emscripten/fetch.py

File src/urllib3/contrib/emscripten/fetch.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027urllib3-2.7.0/src/urllib3/contrib/emscripten/fetch.py

File urllib3-2.7.0/src/urllib3/contrib/emscripten/fetch.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027src/urllib3/util/retry.py

File src/urllib3/util/retry.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027urllib3-2.7.0/src/urllib3/util/retry.py

File urllib3-2.7.0/src/urllib3/util/retry.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highHardcoded public IP in network codeATK-028src/urllib3/util/url.py

File src/urllib3/util/url.py contains a hardcoded public IP (a::b) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/src/urllib3/util/url.py

File urllib3-2.7.0/src/urllib3/util/url.py contains a hardcoded public IP (a::b) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028test/test_compatibility.py

File test/test_compatibility.py contains a hardcoded public IP (18:49:35) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/test_compatibility.py

File urllib3-2.7.0/test/test_compatibility.py contains a hardcoded public IP (18:49:35) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028test/test_connection.py

File test/test_connection.py contains a hardcoded public IP (1.1.1.1) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/test_connection.py

File urllib3-2.7.0/test/test_connection.py contains a hardcoded public IP (1.1.1.1) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028test/test_connectionpool.py

File test/test_connectionpool.py contains a hardcoded public IP (2607:f8b0:4005:805) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/test_connectionpool.py

File urllib3-2.7.0/test/test_connectionpool.py contains a hardcoded public IP (2607:f8b0:4005:805) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028test/test_poolmanager.py

File test/test_poolmanager.py contains a hardcoded public IP (92:81:FE:85:F7:0C:26:60) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/test_poolmanager.py

File urllib3-2.7.0/test/test_poolmanager.py contains a hardcoded public IP (92:81:FE:85:F7:0C:26:60) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028test/test_retry.py

File test/test_retry.py contains a hardcoded public IP (7.1.1.1) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/test_retry.py

File urllib3-2.7.0/test/test_retry.py contains a hardcoded public IP (7.1.1.1) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028test/test_ssl.py

File test/test_ssl.py contains a hardcoded public IP (8.8.8.8) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/test_ssl.py

File urllib3-2.7.0/test/test_ssl.py contains a hardcoded public IP (8.8.8.8) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028test/test_util.py

File test/test_util.py contains a hardcoded public IP (173.194.35.7) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/test_util.py

File urllib3-2.7.0/test/test_util.py contains a hardcoded public IP (173.194.35.7) used in network code — review for hidden exfiltration or C2 endpoints.

highDynamic module load with remote sourceATK-027test/with_dummyserver/test_connectionpool.py

File test/with_dummyserver/test_connectionpool.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027urllib3-2.7.0/test/with_dummyserver/test_connectionpool.py

File urllib3-2.7.0/test/with_dummyserver/test_connectionpool.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highHardcoded public IP in network codeATK-028test/with_dummyserver/test_https.py

File test/with_dummyserver/test_https.py contains a hardcoded public IP (55:39:BF:70:05:12:43:FA) used in network code — review for hidden exfiltration or C2 endpoints.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/with_dummyserver/test_https.py

File urllib3-2.7.0/test/with_dummyserver/test_https.py contains a hardcoded public IP (55:39:BF:70:05:12:43:FA) used in network code — review for hidden exfiltration or C2 endpoints.

highDynamic module load with remote sourceATK-027test/with_dummyserver/test_poolmanager.py

File test/with_dummyserver/test_poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027urllib3-2.7.0/test/with_dummyserver/test_poolmanager.py

File urllib3-2.7.0/test/with_dummyserver/test_poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highDynamic module load with remote sourceATK-027test/with_dummyserver/test_proxy_poolmanager.py

File test/with_dummyserver/test_proxy_poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highHardcoded public IP in network codeATK-028test/with_dummyserver/test_proxy_poolmanager.py

File test/with_dummyserver/test_proxy_poolmanager.py contains a hardcoded public IP (0:0:0:0:0:0:0:1) used in network code — review for hidden exfiltration or C2 endpoints.

highDynamic module load with remote sourceATK-027urllib3-2.7.0/test/with_dummyserver/test_proxy_poolmanager.py

File urllib3-2.7.0/test/with_dummyserver/test_proxy_poolmanager.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/with_dummyserver/test_proxy_poolmanager.py

File urllib3-2.7.0/test/with_dummyserver/test_proxy_poolmanager.py contains a hardcoded public IP (0:0:0:0:0:0:0:1) used in network code — review for hidden exfiltration or C2 endpoints.

highDynamic module load with remote sourceATK-027test/with_dummyserver/test_socketlevel.py

File test/with_dummyserver/test_socketlevel.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highHardcoded public IP in network codeATK-028test/with_dummyserver/test_socketlevel.py

File test/with_dummyserver/test_socketlevel.py contains a hardcoded public IP (2001:4998:c:a06) used in network code — review for hidden exfiltration or C2 endpoints.

highDynamic module load with remote sourceATK-027urllib3-2.7.0/test/with_dummyserver/test_socketlevel.py

File urllib3-2.7.0/test/with_dummyserver/test_socketlevel.py builds a dynamic import/require argument alongside network access — possible remote module loading.

highHardcoded public IP in network codeATK-028urllib3-2.7.0/test/with_dummyserver/test_socketlevel.py

File urllib3-2.7.0/test/with_dummyserver/test_socketlevel.py contains a hardcoded public IP (2001:4998:c:a06) used in network code — review for hidden exfiltration or C2 endpoints.

Package metadata

LicenseUnknown

HTTP library with thread-safe connection pooling, file post, and more.

Files in package (244)

CHANGES.rsturllib3-2.7.0/CHANGES.rstuv.lockurllib3-2.7.0/uv.lockdocs/Makefileurllib3-2.7.0/docs/Makefiledocs/advanced-usage.rsturllib3-2.7.0/docs/advanced-usage.rstdocs/changelog.rsturllib3-2.7.0/docs/changelog.rstdocs/conf.pyurllib3-2.7.0/docs/conf.pydocs/contributing.rsturllib3-2.7.0/docs/contributing.rstdocs/index.rsturllib3-2.7.0/docs/index.rstdocs/make.baturllib3-2.7.0/docs/make.batdocs/sponsors.rsturllib3-2.7.0/docs/sponsors.rstdocs/user-guide.rsturllib3-2.7.0/docs/user-guide.rstdocs/v2-migration-guide.rsturllib3-2.7.0/docs/v2-migration-guide.rstdocs/_static/banner.svgurllib3-2.7.0/docs/_static/banner.svgdocs/_static/banner_github.svgurllib3-2.7.0/docs/_static/banner_github.svgdocs/_static/dark-logo.svgurllib3-2.7.0/docs/_static/dark-logo.svgdocs/images/demo-button.pngurllib3-2.7.0/docs/images/demo-button.pngdocs/images/favicon.pngurllib3-2.7.0/docs/images/favicon.pngdocs/images/learn-more-button.pngurllib3-2.7.0/docs/images/learn-more-button.pngdocs/images/logo.pngurllib3-2.7.0/docs/images/logo.pngdocs/images/logo.svgurllib3-2.7.0/docs/images/logo.svg

How ShadowCanopy checks PyPI packages

ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.

Protect your projects free See what's being blocked

Other PyPI packages

requests flask django numpy pandas boto3 pytest pip setuptools python-dateutil pyyaml cryptography

This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/pypi/urllib3

urllib3 — deep security report