---
id: maec
version: "4.1.0.17"
license: BSD
license_treatment: permissive
maintenance: abandoned
---

# maec — An API for parsing and creating MAEC content.

License: permissive · Maintenance: abandoned · Downloads: 84.5K/mo

## What it is and what it does

python-maec is a library for working with MAEC v4.1, a standardized format for describing malware attributes and behavior. It provides two API layers: a low-level set of auto-generated Python classes that map directly to the MAEC XML schema (allowing full schema coverage), and a higher-level set of manually designed Python classes intended to feel more natural to Python developers (though covering only frequently-used object types). The library can parse MAEC from XML, generate MAEC to XML, and export to JSON via Python dictionaries.

The package depends on lxml, cybox, and mixbox. It is distributed as a pure wheel with low install friction, but has been abandoned since 2020-11-16 and is untested against Python versions beyond 3.8. The last commit predates modern Python releases by years, raising compatibility concerns for current development environments.

Use it for:

- Parse existing MAEC v4.1 XML documents to extract malware attribute and behavior data in Python.
- Generate MAEC v4.1 content programmatically and export to XML or JSON for malware analysis reporting.
- Integrate malware characterization data into security tools or threat intelligence platforms that consume MAEC.
- Convert MAEC content between XML and JSON representations for downstream analysis or storage.
- Build custom malware analysis workflows using the higher-level Python API for common MAEC object types.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Parse, manipulate, and generate MAEC (Malware Attribute Enumeration and Characterization) v4.1 content via low-level XML schema bindings and higher-level Python classes.

No—not for new projects. The package is abandoned (last commit 2020-11-16) and untested on modern Python versions. If you must work with MAEC v4.1 in legacy systems already running Python 2.7 or 3.4–3.8, it may work, but expect no maintenance, no security updates, and no compatibility fixes.

## Install

pip install maec
uv add maec
poetry add maec

## Installing maec

Before you install: Low install friction with a pure-wheel distribution. However, the package is abandoned—last commit was 2020-11-16. It remains untested against Python versions beyond 3.8, and its dependencies may have evolved incompatibly.

License in practice: BSD license is permissive and poses no restrictions on use, modification, or redistribution in most contexts.

Quickstart:

pip install maec

from maec.bindings import maec_core_1_4 as maec
from maec.bundle import Bundle

bundle = Bundle()
# Parse or create MAEC content

lxml requires system libraries (libxml2-dev, libxslt1-dev, zlib1g-dev on Ubuntu) to build from source on some platforms.

Verify before relying:

- Whether the package's dependencies (cybox, mixbox, lxml) remain compatible with Python 3.9+.
- Whether MAEC v4.1 is the current standard or if newer versions exist that this library does not support.
- Whether the low-level binding classes cover the full MAEC v4.1 schema or only a subset.

## Package facts

- License: BSD (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: abandoned
- Downloads: 84.5K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

malware attribute enumeration, MAEC content parsing, malware characterization library, XML schema to Python bindings, MAEC v4.1 support, malware analysis data format, cybersecurity metadata handling, malware-analysis, abandoned, xml-bindings

[View on SkillFed](https://skillfed.io/packages/maec) · [View on PyPI](https://pypi.org/project/maec/)