Malware Detection Python Packages

repo-security-scanner

Pre-clone security scanner for Git repos. Detects crypto miners, backdoors, obfuscation, and vulnerable dependencies before git clone touches your machine. Python CLI with JSON/CSV/SARIF output.

anyrun-sdk

Simplify integration with ANY.RUN REST API services

apkid

Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android

skilltotal

Claude Code plugin that scans a package before the agent runs npx, npm install, pip install, uvx or claude mcp add. Malicious indicators block the install. High-risk packages need your approval. The scan runs on your machine and never executes the code or calls an LLM. Every finding cites a file and line. Also a CLI, GitHub Action and MCP server.

legwork-mcp

Your AI finds the open-source tool it needs on GitHub. Legwork installs it safely, in a sandbox with a malware pre-scan.

quark-engine

An Obfuscation-Neglect Android Malware Scoring System

husk-scanner

Static security scanner for AI agent skills. Built against the bypass techniques that beat Snyk, Cisco & Vercel scanners. Offline, deterministic, zero dependencies, CI-ready. Benchmarked on 11, 225 real malicious skills.

argus-security

Argus brings “a hundred eyes” to your project, combining leading open source security tools into a scalable, automated, continuous security pipeline.

aisbom-cli

Static security scanner for ML model files — detects pickle bombs, Keras Lambda RCE and GGUF template injection, and generates CycloneDX / SPDX AI-BOMs (AIBOM) as EU AI Act, CRA and FDA §524B evidence.

vouch-agent

See what your AI-agent skills can actually do. Vouch audits every SKILL.md on your machine, explains each skill's capabilities in plain English, and flags the risky ones (destructive commands, secret exfiltration, prompt injection). Local, deterministic — like npm audit, but for agent skills.

yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

extuno

Assess a Python package for supply-chain risk before pip installs it. Pre-install gate for pip with sandbox-backed verdicts, SARIF output and CI exit codes.

fibratus

Security sensor for realtime threat detection and protection

forensic-scan

Forensic AST scanner that detects deliberate obfuscation, hidden logic and payloads smuggled in non-code files

yarobot

Simple YARA rules generator with web interface, API, and cli

autopyara

Python Package of AutoPYara

bayyinah

File integrity scanner detecting hidden, concealed, or adversarial content across 23 file kinds. Input-layer application of the Munafiq Protocol

memlapse

A Windows memory forensics tool that records a process's memory map over time, replays it, and scores each region for signs of code injection

threatlens-ml

Detect malicious URLs and Windows executables from Python. Calibrated ML models bundled in the package.

sigilsec

Automated security auditing CLI for AI agent code — quarantine-first workflow for repos, packages, and agent tooling

hemlock-scan

Static supply-chain checks for npm and PyPI packages, lockfiles, provenance, and known malware.

entropystrip

Algorithmic PE de-obfuscator, Shannon entropy radar, and incident triage engine

nodesafe

Security scanner for ComfyUI custom nodes and node-based workflow plugins. Static analysis pipeline + ML, OSS Apache 2.0.

malwar

Static analysis engine for detecting malware in agentic AI skill files