hexora

I'm working on hexora, a library that detects malicious Python code using static analysis and machine learning. Recently, I've added a simple ML model to filter out false positives. In the last month, I found and flagged more than 40 malicious Python packages. Unlike the LLM approach, my library is not susceptible to prompt injection and deobfuscates Python code. Where LLMs see "obfuscated code, potentially harmful", my library decodes it and sees what's happening inside. https://github.com/rushter/hexora

Their previous release would be easily caught by static analysis. PTH is a novel technique. Run all your new dependencies through static analysis and don't install the latest versions. I implemented static analysis for Python that detects close to 90% of such injections. https://github.com/rushter/hexora

I made a new library to detect malicious and harmful behaviour in Python scripts. It uses static analysis with semantic modeling. Even when the code is pretty obfuscated, it can still detect it. For example, it can infer that getattr(sys.modules["built"+"ins"], "".join(reversed(["al","ev"])))("1+1") Is basically: eval("1+1"). Currently, I'm testing it on public files where some of them implement malicious behavior, as well as past malicious packages on PyPI. You can see some of the detection examples here: https://github.com/rushter/hexora/blob/main/docs/examples.md I'd love to hear your feedback and ideas on how to improve this and identify missing rules.

I made a new library to detect malicious and harmful behaviour in Python scripts. There are alternative libraries, but they usually rely on regexes, which can be fragile and tricked. My library uses AST and tracks some of the obfuscation techniques, such as import/call reassignment. Currently, I'm testing it on public files where some of them implement malicious behavior, as well as past malicious packages on PyPI. You can see some of the detection examples here: https://github.com/rushter/hexora/blob/main/docs/examples.md I'd love to hear your feedback and ideas on how to improve this and identify missing rules.