supply chain / sqlalchemy

SQLAlchemy

registryPyPI
package namesqlalchemy
maintainerSQLAlchemy / Mike Bayer

SQLAlchemy is the standard SQL toolkit and ORM for Python, used in Django (via third-party integration), FastAPI, and standalone data applications. It parses database connection strings, manages connection pools, and executes raw and ORM-generated SQL. Most Python web applications that use a SQL database depend on SQLAlchemy.

api usage

Checking SQLAlchemy

sqlalchemy 2.0.0 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.

bash
curl "https://api.attestd.io/v1/check?product=sqlalchemy&version=2.0.0" \
  -H "Authorization: Bearer YOUR_API_KEY"
example response
json
{
  "product": "sqlalchemy",
  "version": "2.0.0",
  "supported": true,
  "risk_state": "none",
  "risk_factors": [],
  "actively_exploited": false,
  "remote_exploitable": false,
  "authentication_required": false,
  "patch_available": false,
  "fixed_version": null,
  "confidence": 0.9,
  "cve_ids": [],
  "cves": null,
  "max_epss": null,
  "typosquat": null,
  "supply_chain_monitored": true,
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null
  },
  "last_updated": "2026-05-01T00:00:00Z"
}
attack surface

Why this package is monitored

SQLAlchemy parses connection URLs and owns the pool used by FastAPI and other Python apps. Compromise can leak the DSN and run raw SQL with the application's database privileges.

Attestd monitors sqlalchemy using the following detection sources:

registry

Manually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.

osv

OSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.

pypi_yank

Versions yanked on PyPI with a security-related yanked_reason annotation. Confidence 0.80.

related