Paramiko

registryPyPI

package nameparamiko

maintainerParamiko Contributors

Paramiko is the standard Python library for SSH2 protocol implementation, used in deployment scripts, server automation, and CI/CD pipelines for remote command execution and SFTP file transfers. It manages SSH private keys, known_hosts verification, and interactive shell sessions to production servers.

api usage

Checking Paramiko

paramiko 3.4.0 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.

bash

curl "https://api.attestd.io/v1/check?product=paramiko&version=3.4.0" \
  -H "Authorization: Bearer YOUR_API_KEY"

example response

json

{
  "product": "paramiko",
  "version": "3.4.0",
  "supported": true,
  "risk_state": "none",
  "risk_factors": [],
  "actively_exploited": false,
  "remote_exploitable": false,
  "authentication_required": false,
  "patch_available": false,
  "fixed_version": null,
  "confidence": 0.9,
  "cve_ids": [],
  "cves": null,
  "max_epss": null,
  "typosquat": null,
  "supply_chain_monitored": true,
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null
  },
  "last_updated": "2026-05-01T00:00:00Z"
}

attack surface

Why this package is monitored

Paramiko loads SSH private keys and decrypt passphrases for deploy scripts and SFTP. Stealing that key material yields persistent access to every host the key trusts.

Attestd monitors paramiko using the following detection sources:

registry

Manually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.

osv

OSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.

pypi_yank

Versions yanked on PyPI with a security-related yanked_reason annotation. Confidence 0.80.

Supply chain overview All PyPI packages Requests HTTPX Response fields