fastapi-expert

No evidence of malware or obfuscation. The documentation includes a significant authorization flaw in delete_user: an authenticated caller can request deletion of an arbitrary user unless authorization is enforced elsewhere. The unauthenticated get_user endpoint may also disclose user data depending on its response model and intended policy.