{"categories":[{"label":"Python Modules","url":"https://skillfed.io/packages/category/software-development-libraries-python-modules/21"}],"enrichment":{"capability":"Maco is a framework for standardizing malware configuration extractor output and execution, providing a common data model and utilities for building, running, and testing extractors.","skillfed_tags":["malware-analysis","security-research","config-extraction"],"use_cases":["Build custom malware config extractors that output standardized, validated data compatible with downstream analysis platforms","Integrate multiple extractor frameworks by harmonizing their output into a common MACO model format","Create unit tests for malware extractors using the provided base test utilities","Run extractors locally via the CLI tool to validate extraction logic during development","Export extracted malware configurations in a machine-friendly format for database ingestion or threat intelligence sharing"],"what_it_does":"Maco is a framework for building standardized malware configuration extractors. It solves two core problems: defining a common ontology for extractor output (via a Pydantic-based data model) and providing a standard way to identify and execute the right parsers for a given sample. The framework includes a base extractor class, a collector for loading and running extractors, a CLI tool for local testing, and utilities for unit testing extractors.\n\nThe package is designed for security researchers and malware analysts who need to extract configuration data from malware samples in a consistent, machine-readable format. It depends on pydantic for data validation and yara-x for pattern matching. The model supports a wide range of malware metadata\u2014families, versions, C2 communications (HTTP, TCP, SSH, DNS, etc.), encryption details, campaign IDs, and custom fields\u2014making it suitable for integration into larger malware analysis platforms and knowledge bases.","worth_installing":"Yes. The package is actively maintained, has low install friction, carries no known vulnerabilities, and uses a permissive MIT license. It is production-stable and actively used by established malware analysis platforms. Install it if you are building or integrating malware configuration extractors and need a standardized output model and execution framework."},"id":"maco-extractor","links":{"html":"https://skillfed.io/packages/maco-extractor","md":"https://skillfed.io/packages/maco-extractor.md","pypi":"https://pypi.org/project/maco-extractor/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-07-07","license_spdx":null,"license_treatment":"permissive","name":"maco-extractor","python_support":"supports_current","summary":"This package contains the essentials for creating Maco extractors and using them at runtime."},"popularity":{"monthly_downloads":90624,"position":13571,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"1.3.2"}