hexora 0.2.3__tar.gz → 0.3.0__tar.gz

{hexora-0.2.3 → hexora-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hexora
-Version: 0.2.3
+Version: 0.3.0
 Summary: Static analysis of malicous Python scripts.
 Author-email: Artem Golubin <me@rushter.com>
 License-Expression: MIT
@@ -18,6 +18,7 @@ Dynamic: license-file
 
 
 Hexora is a static analysis tool designed to detect malicious and harmful patterns in Python code.
+It combines a rule-based static analysis engine with a machine-learned model that scores entire source files to classify them as malicious or benign.
 
 It can be used to:
 
@@ -71,6 +72,7 @@ warning[HX2000]: Reading from the clipboard can be used to exfiltrate sensitive
   │
   = Confidence: High
     Help: Clipboard access can be used to exfiltrate sensitive data such as passwords and keys.
+    Machine learning based score for file: 0.93
 
 warning[HX3000]: Possible execution of unwanted code
    ┌─ resources/test/test.py:20:1
@@ -165,6 +167,7 @@ Right now, the following rules are available:
 | HX1030 | OSFingerprint | Suspicious OS fingerprinting. |
 | HX2000 | ClipboardRead | Reading from the clipboard. |
 | HX2010 | EnvAccess | Access to a sensitive environment variable. |
+| HX2020 | ScreenshotCapture | Capturing screenshots from the display. |
 | HX3000 | CodeExec | Possible code execution. |
 | HX3010 | ShellExec | Execution of a shell command. |
 | HX3040 | DLLInjection | Possible DLL injection. |

{hexora-0.2.3 → hexora-0.3.0}/README.md

@@ -4,6 +4,7 @@
 
 
 Hexora is a static analysis tool designed to detect malicious and harmful patterns in Python code.
+It combines a rule-based static analysis engine with a machine-learned model that scores entire source files to classify them as malicious or benign.
 
 It can be used to:
 
@@ -57,6 +58,7 @@ warning[HX2000]: Reading from the clipboard can be used to exfiltrate sensitive
   │
   = Confidence: High
     Help: Clipboard access can be used to exfiltrate sensitive data such as passwords and keys.
+    Machine learning based score for file: 0.93
 
 warning[HX3000]: Possible execution of unwanted code
    ┌─ resources/test/test.py:20:1
@@ -151,6 +153,7 @@ Right now, the following rules are available:
 | HX1030 | OSFingerprint | Suspicious OS fingerprinting. |
 | HX2000 | ClipboardRead | Reading from the clipboard. |
 | HX2010 | EnvAccess | Access to a sensitive environment variable. |
+| HX2020 | ScreenshotCapture | Capturing screenshots from the display. |
 | HX3000 | CodeExec | Possible code execution. |
 | HX3010 | ShellExec | Execution of a shell command. |
 | HX3040 | DLLInjection | Possible DLL injection. |

hexora-0.3.0/hexora/__init__.pyi

@@ -0,0 +1,81 @@
+from typing import List, Optional, Tuple, TypedDict, Literal, Union
+import os
+
+class AuditItem(TypedDict):
+    label: str
+    rule: str
+    description: str
+    confidence: Literal["very_low", "low", "medium", "high", "very_high"]
+    location: Optional[Tuple[int, int]]
+    annotation: Optional[str]
+
+class AuditResult(TypedDict):
+    items: List[AuditItem]
+    path: str
+    archive_path: Optional[str]
+
+def audit_path(input_path: Union[str, os.PathLike[str]]) -> List[AuditResult]:
+    """
+    Runs audit in the specified folder.
+
+    Example:
+        >>> import hexora
+        >>> results = hexora.audit_path("hexora/resources/test/")
+        >>> results[0]
+        {
+            "items": [
+                {
+                    "label": "pyperclip",
+                    "rule": "HX5010",
+                    "description": "pyperclip can be used to copy and paste data from the clipboard.",
+                    "confidence": "low",
+                    "location": (7, 16),
+                    "annotation": None,
+                }
+            ],
+            "path": "hexora/resources/test/clipboard_01.py",
+            "archive_path": None,
+        }
+    """
+    ...
+
+def audit_file(
+    input_path: Union[str, os.PathLike[str]],
+) -> List[AuditResult]:
+    """
+    Runs audit for the specified path.
+
+    Returns ``List[AuditResult]`` for both regular files and archives
+    (``.zip`` or ``.tar.gz``).
+
+    Example (regular file):
+        >>> import hexora
+        >>> result = hexora.audit_file("resources/test/exec_02.py")
+        >>> result[0]
+        {
+            'items': [
+                {
+                    'label': 'eval',
+                    'rule': 'HX3000',
+                    'description': 'Possible execution of unwanted code.',
+                    'confidence': 'medium',
+                    'location': (17, 36),
+                    'annotation': 'warning[HX3000]: Possible execution of unwanted code...Confidence: Medium'
+                },
+                {
+                    'label': 'builtins.exec',
+                    'rule': 'HX3000',
+                    'description': 'Possible execution of unwanted code.',
+                    'confidence': 'very_high',
+                    'location': (37, 65),
+                    'annotation': 'warning[HX3000]: Possible execution of unwanted code...Confidence: VeryHigh'
+                },
+                ...
+            ],
+            'path': 'resources/test/exec_02.py',
+            'archive_path': None
+        }
+    """
+    ...
+
+def run_cli() -> None: ...

{hexora-0.2.3 → hexora-0.3.0}/hexora.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hexora
-Version: 0.2.3
+Version: 0.3.0
 Summary: Static analysis of malicous Python scripts.
 Author-email: Artem Golubin <me@rushter.com>
 License-Expression: MIT
@@ -18,6 +18,7 @@ Dynamic: license-file
 
 
 Hexora is a static analysis tool designed to detect malicious and harmful patterns in Python code.
+It combines a rule-based static analysis engine with a machine-learned model that scores entire source files to classify them as malicious or benign.
 
 It can be used to:
 
@@ -71,6 +72,7 @@ warning[HX2000]: Reading from the clipboard can be used to exfiltrate sensitive
   │
   = Confidence: High
     Help: Clipboard access can be used to exfiltrate sensitive data such as passwords and keys.
+    Machine learning based score for file: 0.93
 
 warning[HX3000]: Possible execution of unwanted code
    ┌─ resources/test/test.py:20:1
@@ -165,6 +167,7 @@ Right now, the following rules are available:
 | HX1030 | OSFingerprint | Suspicious OS fingerprinting. |
 | HX2000 | ClipboardRead | Reading from the clipboard. |
 | HX2010 | EnvAccess | Access to a sensitive environment variable. |
+| HX2020 | ScreenshotCapture | Capturing screenshots from the display. |
 | HX3000 | CodeExec | Possible code execution. |
 | HX3010 | ShellExec | Execution of a shell command. |
 | HX3040 | DLLInjection | Possible DLL injection. |

{hexora-0.2.3 → hexora-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = 'hexora'
-version = '0.2.3'
+version = '0.3.0'
 description = 'Static analysis of malicous Python scripts.'
 readme = 'README.md'
 requires-python = '>=3.9'

hexora-0.2.3/hexora/__init__.pyi

@@ -1,26 +0,0 @@
-from typing import List, Optional, Tuple, TypedDict, Literal, Union
-import os
-
-class AuditItem(TypedDict):
-    label: str
-    rule: str
-    description: str
-    confidence: Literal["very_low", "low", "medium", "high", "very_high"]
-    location: Optional[Tuple[int, int]]
-
-class AuditResult(TypedDict):
-    items: List[AuditItem]
-    path: str
-    archive_path: Optional[str]
-
-def audit_path(input_path: Union[str, os.PathLike[str]]) -> List[AuditResult]:
-    """
-    Runs audit in the specified folder.
-    """
-    ...
-
-def audit_file(input_path: Union[str, os.PathLike[str]]) -> AuditResult:
-    """
-    Runs audit for the specified file.
-    """
-    ...