boto3 (AWS SDK)
PyPIboto3boto3 is the official AWS SDK for Python, used to interact with S3, EC2, Lambda, DynamoDB, SQS, and virtually every other AWS service. It reads credentials from environment variables, `~/.aws/credentials`, or IAM instance metadata, and is present in nearly every Python application deployed on AWS.
Checking boto3 (AWS SDK)
boto3 1.34.0 is a clean version with no known supply chain compromise. The response returns compromised: false with an empty sources array.
curl "https://api.attestd.io/v1/check?product=boto3&version=1.34.0" \
-H "Authorization: Bearer YOUR_API_KEY"{
"product": "boto3",
"version": "1.34.0",
"supported": true,
"risk_state": "none",
"supply_chain": {
"compromised": false,
"sources": [],
"malware_type": null,
"description": null,
"advisory_url": null,
"compromised_at": null,
"removed_at": null
},
"last_updated": "2026-05-01T00:00:00Z"
}Why this package is monitored
AWS SDK packages load IAM credentials during initialization, often before any application code runs. A compromised version can exfiltrate these credentials, which may have broad cross-service permissions depending on the IAM policy attached to the role or key.
Attestd monitors boto3 using the following detection sources:
registryManually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.
osvOSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.
pypi_yankVersions yanked on PyPI with a security-related yanked_reason annotation. Confidence 0.80.