Security packages

Parses, manipulates, and generates STIX v1.2.0 (Structured Threat Information eXpression) content in Python, enabling programmatic work with threat intelligence data structures.

However, it is abandoned and will not receive updates.

Generates domain name permutations to detect typosquatting, phishing, and brand impersonation attacks, with optional live phishing detection via HTML and visual similarity analysis.

An MCP server that scans Debian systems for known security vulnerabilities in installed packages and provides CVE details with EPSS exploit prediction scores.

However, note that this is the final release under the debsecan-mcp name—migrate to the renamed debvulns package for future updates.

Expands and deobfuscates AWS IAM action patterns, resolving wildcards and inverting action sets to reveal the concrete permissions they represent.

Parses HTML and API responses from 130+ social platforms to extract account metadata—usernames, display names, bios, avatars, locations, join dates, follower counts, and stable internal identifiers (GAIA ID, Facebook UID, Instagram pk, etc.) that persist across renames and redesigns.

Install it if you need to correlate social accounts, feed OSINT pipelines, or extract account metadata at scale.

PyRIT is a framework for security professionals to identify and assess risks in generative AI systems through automated testing and red-teaming capabilities.

Install it if you need systematic red-teaming capabilities; skip it if you are not evaluating LLM security.

Translates Sigma detection rules into Splunk search queries, supporting both plain queries and savedsearches.conf format output.

Searches for usernames across 400+ social networks to identify and locate accounts associated with a given identity.

Converts defanged indicators of compromise (IOCs) like `example[.]com` back to `example.com`, and conversely fangs normal IOCs to obfuscated forms for safe sharing in threat intelligence.

A pure-Python Kerberos client library supporting password, certificate (PKINIT), and key-based authentication with both synchronous and asynchronous APIs.

However, the 289-day gap between last commit and latest release suggests maintenance is infrequent—verify that its PKINIT and delegation features meet your current…

Translates Sigma security rules into Elasticsearch query formats including Lucene, EQL, and Kibana NDJSON, with processing pipelines for Windows, Zeek, Kubernetes, and macOS event log mappings.

Install it if you author or deploy Sigma rules and need to run them against Elasticsearch.

Adds Microsoft Authentication Library (MSAL) integration to Streamlit applications, enabling Azure AD sign-in via pop-up windows with minimal setup.

However, dormant maintenance and an undefined license are concerns—verify compatibility with your Streamlit version and clarify the license terms with the maintainer…

CodeShield filters code generated by LLMs to detect and block insecure patterns before they reach production, using static analysis across multiple programming languages.

Install only if you actually integrate LLM code output into your pipeline; it's not a general-purpose static analyzer.

nono-py provides Python bindings for OS-enforced sandboxing using Landlock (Linux) and Seatbelt (macOS), letting you restrict a process's filesystem and network access before execution.

Implements the Secure Remote Password (SRP) protocol for password-based mutual authentication over insecure networks without relying on external certificate infrastructure.

However, dormant maintenance (no releases in 651 days) means security updates or bug fixes may be slow; evaluate whether the protocol itself and this implementation…

avidtools provides Pydantic data models and connectors for structuring AI vulnerability reports in the AVID format, with built-in support for pulling data from sources like MITRE ATLAS.

Install it if AVID compliance or MITRE ATLAS integration is part of your workflow; skip it if you don't need structured AI vulnerability reporting.

Cloudauthz obtains temporary credentials from AWS, Azure, or GCP by exchanging provider-specific configuration for short-lived access tokens.

Provides Python protobuf message definitions and serialization code for Sigstore cryptographic signing and verification workflows.

Parse, compile, and match FLIRT signatures (Fast Library Identification and Recognition Technology) against byte sequences to recognize statically-linked code without IDA Pro.

Provides a unified runtime kernel and trust layer for building, executing, and governing multi-agent systems with audit trails, privilege isolation, and identity management.

Command-line tool to decode, brute-force, and forge Flask session cookies by attempting to guess or verify the server's secret key against wordlists.

However, maintenance is dormant (last release 619 days ago), so expect no active support; use it for one-off testing rather than as a dependency in production code.

BloodHound.py is a Python ingestor that enumerates Active Directory domain structure, relationships, and security configurations and exports them for analysis in BloodHound (versions 4.2 and 4.3).

PySentry scans Python projects for known security vulnerabilities by reading dependency manifests and lock files, checking them against multiple vulnerability databases, and reporting findings with severity levels and upgrade paths.

A mock OpenID Connect provider server that runs locally to test and develop OpenID authentication flows without needing a real identity provider.

Parses hypervisor disk, backup, and configuration files from various virtualization platforms, extracting structured data for forensic analysis and system inspection.

Command-line tool to encrypt and decrypt files and directories using AWS Encryption SDK, with support for AWS KMS key management and encryption context.

Install it if your use case fits; avoid it if you need active feature development or prefer a more frequently updated tool.

Wraps checkov to provide infrastructure-as-code static analysis through a bridgecrew CLI interface.

Vivisect is a pure-Python disassembler, debugger, emulator, and static analysis framework for binary analysis and reverse engineering.

Install it if you do reverse engineering, malware analysis, or security research; skip it if you need only simple disassembly or prefer established alternatives like…

Fuzzfetch retrieves Firefox, Spidermonkey, and Thunderbird builds from Mozilla's Firefox-CI Taskcluster instance, supporting specialized build types like AddressSanitizer, ThreadSanitizer, debug, and fuzzing variants.

Install it if you regularly need to fetch Firefox, Spidermonkey, or Thunderbird builds from Firefox-CI.

Replaces Django's opaque session backend with queryable ORM objects tied to users, letting you list active sessions, log out users globally, and access IP and user-agent data.

Provides unified authentication handling across multiple protocols and mechanisms, abstracting away protocol-specific details behind a common interface.

Extracts and lists dependencies from multiple Python project file formats including pyproject.toml, uv.lock, and requirements.txt.

Provides a safer subclass of Python's standard netrc parser that enforces strict file permissions and supports custom netrc file paths via environment variable.

Dlint is a flake8 plugin that adds security-focused and best-practice linting rules to Python code analysis, flagging insecure patterns like use of exec, unsafe deserialization, and other code quality issues.

However, the aging maintenance status means you should verify compatibility with your current Python and flake8 versions before relying on it for critical security…

A certbot plugin that automates DNS-01 challenge validation for DuckDNS domains by managing TXT record creation and deletion through the DuckDNS API.

Install it if you use DuckDNS and want to automate Let's Encrypt certificate issuance; skip it only if you use a different DNS provider or prefer manual certificate…

Provides Python bindings to post-quantum cryptographic algorithms (key encapsulation and digital signatures) that resist attacks from both classical and quantum computers.

Parses disk volume and partition systems including LVM2, GPT, and MBR to extract partition metadata and structure.

However, the AGPL-3.0-or-later license requires careful review if you plan to use it in proprietary software.

Scans Python Pickle files and related serialized model formats to detect suspicious or malicious code execution patterns before loading them.

Provides additional password validators for Django that enforce character-type requirements and prevent password reuse within a configurable history window.

However, dormant maintenance (no updates in 977 days) means you should verify compatibility with your Django version and be prepared to fork or patch if issues arise.

Provides utility functions and helpers for analyzing and manipulating binaries using the vivisect disassembly and analysis framework.