setuptools

registryPyPI

package namesetuptools

maintainerPython Packaging Authority

setuptools is the foundational Python package build system, present in virtually every Python environment as a transitive dependency. It is used by pip to build packages from source and by projects that define `setup.py` or `pyproject.toml`. As a near-universal dependency, a compromise propagates to every package install step.

api usage

Checking setuptools

setuptools 72.0.0 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.

bash

curl "https://api.attestd.io/v1/check?product=setuptools&version=72.0.0" \
  -H "Authorization: Bearer YOUR_API_KEY"

example response

json

{
  "product": "setuptools",
  "version": "72.0.0",
  "supported": true,
  "risk_state": "none",
  "risk_factors": [],
  "actively_exploited": false,
  "remote_exploitable": false,
  "authentication_required": false,
  "patch_available": false,
  "fixed_version": null,
  "confidence": 0.9,
  "cve_ids": [],
  "cves": null,
  "max_epss": null,
  "typosquat": null,
  "supply_chain_monitored": true,
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null
  },
  "last_updated": "2026-05-01T00:00:00Z"
}

attack surface

Why this package is monitored

setuptools executes during pip install and source builds for a large share of Python environments. Code at that stage can read active env vars, SSH agents, and cloud credentials while packages are installed.

Attestd monitors setuptools using the following detection sources:

registry

Manually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.

osv

OSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.

pypi_yank

Versions yanked on PyPI with a security-related yanked_reason annotation. Confidence 0.80.

Supply chain overview All PyPI packages pytest Response fields