
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
awsiotsdk
Advanced tools
The AWS IoT Device SDK for Python v2 connects your Python applications and devices to the AWS IoT platform. It handles the complexities of secure communication, authentication, and device management so you can focus on your IoT solution. The SDK makes it easy to use AWS IoT services like Device Shadows, Jobs, and Fleet Provisioning.
Supported Platforms: Linux, Windows 11+, macOS 14+
Note: The SDK is known to work on older platform versions, but we only guarantee compatibility for the platforms listed above.
Topics:
The primary purpose of the AWS IoT Device SDK for Python v2 is to simplify the process of connecting devices to AWS IoT Core and interacting with AWS IoT services on various platforms. The SDK provides:
The recommended way to use the AWS IoT Device SDK for Python v2 in your project is to install it from PyPI.
To develop applications with the AWS IoT Device SDK for Python v2, you need:
See detailed setup instructions for more information.
python3 -m pip install awsiotsdk
python -m pip install awsiotsdk
See the Development Guide for detailed instructions on building from source and using local builds.
To get started with the AWS IoT Device SDK for Python v2:
Install the SDK - See the Installation section for installation details
Choose your connection method - The SDK supports multiple authentication methods including X.509 certificates, AWS credentials, and custom authentication. MQTT5 User Guide connection section and MQTT5 X509 sample provide more guidance
Follow a complete example - Check out the samples directory
Learn MQTT5 features - For advanced usage and configuration options, see the MQTT5 User Guide
Check out the samples directory for working code examples that demonstrate:
The samples provide ready-to-run code with detailed setup instructions for each authentication method and use case.
The best way to interact with our team is through GitHub.
If you have a support plan with AWS Support, you can also create a new support case.
[!NOTE] This SDK does not support TLS 1.3 on macOS. Support for TLS 1.3 on macOS is planned for a future release.
Please note that on Mac, once a private key is used with a certificate, that certificate-key pair is imported into the Mac Keychain. All subsequent uses of that certificate will use the stored private key and ignore anything passed in programmatically. Beginning in v1.7.3, when a stored private key from the Keychain is used, the following will be logged at the "info" log level:
static: certificate has an existing certificate-key pair that was previously imported into the Keychain.
Using key from Keychain instead of the one provided.
Check out our resources for additional guidance too before opening an issue:
This library is licensed under the Apache 2.0 License.
Latest released version: v1.28.2
FAQs
AWS IoT SDK based on the AWS Common Runtime
We found that awsiotsdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.