pdfid
PDFID simple tool to analyze PDF malicious files by DidierStevens. Customized by Matteo Lodi to be used as a library.
Decision gist · record as of 2026-08-14
Yes, if you need lightweight PDF structural analysis and can accept that the tool is no longer maintained. The low install friction and permissive license make it practical for security workflows, but verify that its heuristics meet your threat model and test compatibility with your Python environment before relying on it in production.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 2.6 or later (up to Python 3.x); verify compatibility with your specific Python version before use in production.
- Low install friction with no runtime dependencies.
- However, the package is abandoned—last updated 2023-06-06, over 1165 days ago—so expect no maintenance, bug fixes, or compatibility updates for modern Python versions.
License · maintenance · safety
permissive license (permissive) — MIT license permits free use, modification, and distribution with minimal restrictions, making it suitable for both open-source and commercial projects.
last release 2023-06-06 (1165 days) · last repo commit 2023-06-06 · 21 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 295,599 downloads/mo, #7,920 on PyPI
Alternatives
Verify before relying
pip install pdfid
import pdfid
# See test.py in the repository for library usage examples- Whether the tool's PDF analysis heuristics remain effective against current malware techniques and PDF specifications.
- Compatibility with Python versions beyond what was tested at the time of the last release.
What it is and what it does
pdfid is a port of Didier Stevens' PDF analysis tool, designed to detect potentially malicious PDF files by examining their structure and embedded objects. It works as both a standalone command-line utility and as an importable Python library, allowing you to programmatically scan PDFs for suspicious characteristics without requiring external dependencies.
The tool identifies PDF features commonly associated with exploits—such as embedded JavaScript, suspicious object types, or unusual compression—to help security researchers and developers flag files that warrant deeper inspection. Because it has no runtime dependencies and supports a wide Python version range, it integrates easily into existing workflows, though its analysis approach is structural rather than behavioral.
Use it for
- Scan uploaded PDFs in a web application to flag potentially malicious files before processing or storage.
- Batch-analyze PDF repositories to identify suspicious documents for manual review by security teams.
- Integrate PDF threat detection into automated malware scanning pipelines or security monitoring systems.
- Examine PDF structure during reverse-engineering or incident response investigations.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need lightweight PDF structural analysis and can accept that the tool is no longer maintained.
The low install friction and permissive license make it practical for security workflows, but verify that its heuristics meet your threat model and test compatibility with your Python environment before relying on it in production.
Install
pdfid on PyPI
Before you install
Low install friction with no runtime dependencies. However, the package is abandoned—last updated 2023-06-06, over 1165 days ago—so expect no maintenance, bug fixes, or compatibility updates for modern Python versions.
Requires Python 2.6 or later (up to Python 3.x); verify compatibility with your specific Python version before use in production.
License in practice
MIT license permits free use, modification, and distribution with minimal restrictions, making it suitable for both open-source and commercial projects.
Quickstart
pip install pdfid
import pdfid
# See test.py in the repository for library usage examplesVerify before relying
- Whether the tool's PDF analysis heuristics remain effective against current malware techniques and PDF specifications.
- Compatibility with Python versions beyond what was tested at the time of the last release.
Package facts
| License | permissive license permissive |
| Python support | Supports the current Python release >=2.6, <4 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | None |
| Maintenance | Abandoned 1,165 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 295,599 / month, #7,920 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | License :: OSI Approved :: MIT LicenseProgramming Language :: Python |
Evidence: pdfid-1.1.3-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “pdf malware analysis”
- pdfidAnalyzes PDF files to identify potentially malicious content by…
- malduckMalduck provides cryptographic, compression, and memory-analysis…
- maco-extractorMaco is a framework for standardizing malware configuration extractor…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also oletools · pymupdf-layout · pdfminer.six · mail-parser · picklescan · pymisp · ca9 · guarddog · pyPPG · pypdf