Together AI SDK

registryPyPI

package nametogether

maintainerTogether AI

The Together AI Python SDK provides access to open-source models (Llama 3, Mixtral, Qwen, and others) hosted on Together's inference cloud. It is used to run fine-tuned or open-weight models in production without managing GPU infrastructure. API keys grant access to all models and fine-tuning jobs under the account.

api usage

Checking Together AI SDK

together 1.3.0 is a clean version with no known supply chain compromise. The response returns compromised: false with an empty sources array.

bash

curl "https://api.attestd.io/v1/check?product=together&version=1.3.0" \
  -H "Authorization: Bearer YOUR_API_KEY"

json

{
  "product": "together",
  "version": "1.3.0",
  "supported": true,
  "risk_state": "none",
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null
  },
  "last_updated": "2026-05-01T00:00:00Z"
}

attack surface

Why this package is monitored

Cloud inference SDK packages hold platform API keys that may also cover fine-tuning job data, uploaded datasets, and billing controls, making a single compromised key more impactful than a standard model API key.

Attestd monitors together using the following detection sources:

registry

Manually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.

osv

OSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.

pypi_yank

Versions yanked on PyPI with a security-related yanked_reason annotation. Confidence 0.80.

Supply chain overview All PyPI packages OpenAI SDK (Python)Anthropic SDK (Python)HuggingFace Transformers Response fields