pandas
PyPIpandaspandas is the standard library for tabular data manipulation in Python, providing the DataFrame and Series types used in data analysis, ETL pipelines, and ML feature engineering. It is present in essentially every data science environment and is a standard dependency of BI tooling and notebook-based workflows.
Checking pandas
pandas 2.2.0 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.
curl "https://api.attestd.io/v1/check?product=pandas&version=2.2.0" \
-H "Authorization: Bearer YOUR_API_KEY"{
"product": "pandas",
"version": "2.2.0",
"supported": true,
"risk_state": "none",
"risk_factors": [],
"actively_exploited": false,
"remote_exploitable": false,
"authentication_required": false,
"patch_available": false,
"fixed_version": null,
"confidence": 0.9,
"cve_ids": [],
"cves": null,
"max_epss": null,
"typosquat": null,
"supply_chain_monitored": true,
"supply_chain": {
"compromised": false,
"sources": [],
"malware_type": null,
"description": null,
"advisory_url": null,
"compromised_at": null,
"removed_at": null
},
"last_updated": "2026-05-01T00:00:00Z"
}Why this package is monitored
pandas DataFrames often hold PII, financial rows, or training extracts inside ETL and notebook pipelines. Malicious code in read/transform paths can copy that tabular data before anonymization or encryption runs.
Attestd monitors pandas using the following detection sources:
registryManually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.
osvOSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.
pypi_yankVersions yanked on PyPI with a security-related yanked_reason annotation. Confidence 0.80.