yara-python
Python interface for YARA
Decision gist · record as of 2026-08-14
Yes. yara-python is actively maintained, has no known vulnerabilities, carries a permissive license, and offers pre-built wheels for common platforms. Install friction is moderate but manageable. It is the standard way to use YARA from Python and is well-suited for security, malware analysis, and pattern-matching workflows.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Pre-built wheels are available for common platforms; if using dynamic linking, YARA must be built and installed separately before installing yara-python.
- Medium install friction due to compiled C extension bindings; pre-built wheels are available for common platforms (macOS, Linux, Windows across multiple architectures), but dynamic linking requires building YARA separately.
- Last release was 444 days ago; repository is active with recent commits.
License · maintenance · safety
Apache 2.0 (permissive) — Apache 2.0 permissive license allows commercial use, modification, and distribution with minimal restrictions—suitable for most projects.
last release 2025-05-27 (444 days) · last repo commit 2026-07-28 · 751 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 1,796,639 downloads/mo, #3,549 on PyPI
Alternatives
Verify before relying
pip install yara-python
import yara
rule = yara.compile(source='rule foo: bar {strings: $a = "lmn" condition: $a}')
matches = rule.match(data='abcdefgjiklmnoprstuvwxyz')
print(matches[0].rule, matches[0].strings)- Whether Python version support is documented beyond the unspecified classifier
- Performance characteristics for large-scale scanning or complex rule sets
What it is and what it does
yara-python is a Python binding to YARA, the pattern-matching engine developed by VirusTotal. It allows you to write rules that describe patterns in data—typically used for malware detection, log analysis, and security scanning—and then compile and execute those rules against files, strings, or process memory from Python code.
The library exposes YARA's full feature set: you define rules using YARA's domain-specific syntax (strings, conditions, tags), compile them into rule objects, and call match() to scan data. Results include the matched rule name, tags, and detailed information about each string match, including offset and matched length. No runtime dependencies are required beyond the compiled C extension.
Use it for
- Malware detection and threat hunting by scanning files or memory against known malicious patterns
- Log analysis and security event correlation by matching structured or unstructured text against detection rules
- Content filtering and data classification by scanning strings or file contents against custom rule sets
- Incident response automation by integrating YARA scanning into Python-based security workflows
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
yara-python is actively maintained, has no known vulnerabilities, carries a permissive license, and offers pre-built wheels for common platforms. Install friction is moderate but manageable. It is the standard way to use YARA from Python and is well-suited for security, malware analysis, and pattern-matching workflows.
Install
yara-python on PyPI
Before you install
Medium install friction due to compiled C extension bindings; pre-built wheels are available for common platforms (macOS, Linux, Windows across multiple architectures), but dynamic linking requires building YARA separately. Last release was 444 days ago; repository is active with recent commits.
Pre-built wheels are available for common platforms; if using dynamic linking, YARA must be built and installed separately before installing yara-python.
License in practice
Apache 2.0 permissive license allows commercial use, modification, and distribution with minimal restrictions—suitable for most projects.
Quickstart
pip install yara-python
import yara
rule = yara.compile(source='rule foo: bar {strings: $a = "lmn" condition: $a}')
matches = rule.match(data='abcdefgjiklmnoprstuvwxyz')
print(matches[0].rule, matches[0].strings)Verify before relying
- Whether Python version support is documented beyond the unspecified classifier
- Performance characteristics for large-scale scanning or complex rule sets
Package facts
| License | Apache 2.0 permissive |
| Python support | Not specified |
| Install friction | Medium. Platform-specific wheel |
| Runtime dependencies | None |
| Maintenance | Actively maintained 444 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 1,796,639 / month, #3,549 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableLicense :: OSI Approved :: Apache Software LicenseOperating System :: OS IndependentProgramming Language :: Python |
Evidence: yara_python-4.5.4-cp310-cp310-macosx_14_0_arm64.whl; yara_python-4.5.4-cp310-cp310-macosx_14_0_x86_64.whl; yara_python-4.5.4-cp310-cp310-macosx_15_0_arm64.whl; yara_python-4.5.4-cp310-cp310-macosx_15_0_x86_64.whl; yara_python-4.5.4-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl; yara_python-4.5.4-cp310-cp310-manylinux_2_17_i686.manylinux2014_i686.whl; yara_python-4.5.4-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl; yara_python-4.5.4-cp310-cp310-musllinux_1_2_aarch64.whl; yara_python-4.5.4-cp310-cp310-musllinux_1_2_i686.whl; yara_python-4.5.4-cp310-cp310-musllinux_1_2_x86_64.whl; yara_python-4.5.4-cp310-cp310-win32.whl; yara_python-4.5.4-cp310-cp310-win_amd64.whl; yara_python-4.5.4-cp311-cp311-macosx_14_0_arm64.whl; yara_python-4.5.4-cp311-cp311-macosx_14_0_x86_64.whl; yara_python-4.5.4-cp311-cp311-macosx_15_0_arm64.whl; yara_python-4.5.4-cp311-cp311-macosx_15_0_x86_64.whl; yara_python-4.5.4-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl; yara_python-4.5.4-cp311-cp311-manylinux_2_17_i686.manylinux2014_i686.whl; yara_python-4.5.4-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl; yara_python-4.5.4-cp311-cp311-musllinux_1_2_aarch64.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “pattern matching malware detection”
- yara-pythonyara-python provides a Python interface to YARA, enabling you to…
- yara-xPython bindings for YARA-X, a pattern-matching engine for malware…
- pyahocorasickFinds multiple keyword strings in text efficiently using an…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also plyara · yara-x · cisco-ai-mcp-scanner · gitignorant · PyMeta3 · rule-engine · cisco-ai-skill-scanner · gitignorefile · virustotal3 · Parsley