I have been using electrum python (old 3.x.y version) and Appimage on Linux, lately the Appimage of 4.1.2

As 4.1.2 is getting a bit old too, maybe I should update to a more recent version.

However, I am concerned with security, and having python code would allow me to read it.

I know quite a bit of python, but I am no networking Guru- is there maybe a collection of suspicious code fragments to search for in the python code?

This seems esp. important because a malware would be hidden in some otherwise networking unrelated module and be called from some unconspicuous function for obfuscation.
 
Like, the typical routines a malware would use, like establishing network connections other than to the electrum servers etc.?