pypi:web3@8.0.0
PyPI · checked 21 Oct 2026, 23:18 UTC · checker 2026-10-19.2 · log index 948
Record issued 21 Oct 2026
Issued 21 Oct 2026, 23:18 UTC · pypi:web3@8.0.0
quiet
Its install steps ran with decoy credentials in reach and touched nothing we watch.
It ran here and reached for nothing on the network. That is evidence, not proof: code can wait for a different machine.
The trace shows what a step attempted. A quiet trace is evidence, not proof.
Phases
This record does not state its phases one by one; npm records from checker 2026-11-03.1 and Python records from 2026-11-04.3 on do.
Install steps
pypi:web3 has no install step of its own.
No dependency runs anything at install.
What the run reached
No install step reached anything we watch.
- Programs
- python3
- Credentials read
- No credential file or variable was opened.
- Credentials sent
- No decoy left the box.
- Looked for
- file
First import
No first import was recorded for this check.
Dependencies
38 of 38 installed, as npm would on linux x64 musl.
Show all 38
- aiohttp==3.14.5
- eth-abi==6.0.0
- eth-account==0.14.0
- eth-hash==0.8.0
- eth-typing==6.0.0
- eth-utils==6.0.0
- hexbytes==2.0.0
- pydantic==2.14.1
- pyunormalize==18.0.0
- requests==2.34.2
- websockets==17.3
- aiohappyeyeballs==2.7.1
- aiosignal==1.4.0
- attrs==26.1.0
- frozenlist==1.8.0
- multidict==7.1.0
- propcache==0.5.4
- typing-extensions==4.16.0
- yarl==1.25.1
- parsimonious==0.10.0
- bitarray==3.12.3
- eth-keyfile==0.10.0
- eth-keys==0.8.0
- eth-rlp==3.0.0
- rlp==5.0.0
- ckzg==2.1.8
- pycryptodome==3.24.1
- cytoolz==1.2.0
- annotated-types==0.8.0
- pydantic-core==2.50.1
- typing-inspection==0.4.4
- charset-normalizer==3.5.2
- idna==3.20
- urllib3==2.8.0
- certifi==2026.10.19
- regex==2026.9.29
- py-ecc==8.0.0
- toolz==1.2.0
Since the previous version
No comparison with an earlier version was made for this check.
Sandbox
network=none; capabilities=all-dropped; rootfs=read-only; user=nobody; harness=separate-user
Signature and transparency log
- level
- quiet
- verdict
- approved
- reasonCode
- ran_ok
- keyId
- 322a2536e0d5ec8e
- algorithm
- ed25519
- checker
- 2026-10-19.2
- issuedAt
- 2026-10-21T23:18:05Z
- contentSha256
- 2276762aa5d86807eabad5af5c585a84bd6d9a706a613f8456c645a9669ffeb5
- contentSizeBytes
- 1414769 (1.3 MB)
- outputSha256
- 074211474f261aebbd829ddc80e3c44146d598ccf7416f88c75011784f64f2c9
- log index
- 948
Verify the signature yourself, in your browser, at /verify. Kenwea is not in that loop.
Inclusion proofCheckpointKey list
Issued 21 Oct 2026, 23:18 UTC
What this does and does not say
The claim is about the bytes, not the name.
The signature covers these exact bytes. Another version is another check.
A quiet trace is evidence, not proof.
Code that only runs later, when your app calls it, is out of reach.
A signature is not an endorsement.
It says what happened, not that the code is good.
Twenty checks an hour for each network address. When a limit is ours, the record says unfinished and names it.