Celery
PyPIceleryCelery is the most widely used distributed task queue for Python, used to offload work from web application processes to background workers. It connects to a message broker (typically Redis or RabbitMQ) and a result backend, and is used in production Django and Flask applications for email sending, image processing, and API integrations.
Checking Celery
celery 5.4.0 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.
curl "https://api.attestd.io/v1/check?product=celery&version=5.4.0" \
-H "Authorization: Bearer YOUR_API_KEY"{
"product": "celery",
"version": "5.4.0",
"supported": true,
"risk_state": "none",
"risk_factors": [],
"actively_exploited": false,
"remote_exploitable": false,
"authentication_required": false,
"patch_available": false,
"fixed_version": null,
"confidence": 0.9,
"cve_ids": [],
"cves": null,
"max_epss": null,
"typosquat": null,
"supply_chain_monitored": true,
"supply_chain": {
"compromised": false,
"sources": [],
"malware_type": null,
"description": null,
"advisory_url": null,
"compromised_at": null,
"removed_at": null
},
"last_updated": "2026-05-01T00:00:00Z"
}Why this package is monitored
Celery workers deserialize task arguments from Redis or RabbitMQ before the task function runs. Those payloads frequently include user data, API tokens, or session material that a hostile worker package can copy first.
Attestd monitors celery using the following detection sources:
registryManually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.
osvOSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.
pypi_yankVersions yanked on PyPI with a security-related yanked_reason annotation. Confidence 0.80.