malwagon 0.1.0__tar.gz

malwagon-0.1.0/.gitignore

@@ -0,0 +1,4 @@
+dist/
+build/
+*.egg-info/
+__pycache__/

malwagon-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Malwagon
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

malwagon-0.1.0/PKG-INFO

@@ -0,0 +1,165 @@
+Metadata-Version: 2.5
+Name: malwagon
+Version: 0.1.0
+Summary: Submit a file to the Malwagon malware analysis sandbox and print the verdict.
+Project-URL: Homepage, https://malwagon.com
+Project-URL: Documentation, https://malwagon.com/docs/api
+Author-email: Malwagon <info@malwagon.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: cli,dfir,malware,malware-analysis,sandbox,security,threat-intelligence
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: MacOS :: MacOS X
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: OS Independent
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Systems Administration
+Classifier: Topic :: Utilities
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+
+# malwagon
+
+Submit a file to the [Malwagon](https://malwagon.com) malware analysis sandbox
+from the command line, wait for the detonation to finish, and print the verdict.
+
+```console
+$ malwagon suspicious.exe
+uploading suspicious.exe (412.0 KB) to malwagon.com
+scan 48213 queued
+waiting for the sandbox, usually 90 to 300 seconds
+  queued       0s elapsed
+  running      12s elapsed
+  analyzing    2m 18s elapsed
+
+  MALICIOUS  score 88/100
+  sha256 354fd5f5e4afc2280a19c8541fd4abe38bf8fb73efbeb3c2b0a4f2b1d9e0c7a1
+  report https://malwagon.com/s/48213
+```
+
+## Install
+
+```console
+pip install malwagon
+```
+
+Works on Linux, macOS and Windows, on Python 3.8 and newer. It has **no
+dependencies** - the standard library makes the request.
+
+## An API key
+
+Every scan needs one. Mint it in the console under **Settings -> API tokens**,
+give it the submit permission, then store it once:
+
+```console
+$ malwagon login
+Malwagon API key for malwagon.com: 
+key accepted and saved to ~/.config/malwagon/config.json
+```
+
+Or keep it in the environment instead, which is what CI usually wants:
+
+```console
+export MALWAGON_API_KEY=mwg_...
+```
+
+There is deliberately **no `--api-key` flag**. A key on the command line is
+visible to every process on the machine and is written verbatim into your shell
+history.
+
+## Usage
+
+```console
+malwagon FILE [options]
+```
+
+| | |
+|---|---|
+| `--json` | print one JSON object and nothing else |
+| `--no-wait` | submit and exit with the scan id |
+| `--private` | keep the report private (needs a plan that includes it) |
+| `--internet` | detonate with internet access (paid plans only) |
+| `--os KEY` | force a sandbox image |
+| `--timeout-run N` | how long to let the sample run |
+| `--quiet` | drop the progress lines, keep the result |
+
+`malwagon --help` lists all of them.
+
+**The sandbox is chosen from the file, not from a flag.** A Windows binary
+detonates on Windows, an ELF or a Python package on the Linux sandbox, a driver
+reaches the kernel analyzer. Pass `--os` only when you want to override that.
+
+## Exit codes
+
+| code | meaning |
+|---|---|
+| 0 | clean |
+| 1 | malicious |
+| 2 | error |
+| 3 | suspicious |
+
+So a pipeline can gate on it:
+
+```console
+malwagon build/output.exe --quiet || echo "do not ship this"
+```
+
+## Machine-readable output
+
+```console
+$ malwagon sample.dll --json
+{
+  "limitations": [],
+  "report_url": "https://malwagon.com/s/48213",
+  "scan_id": 48213,
+  "score": 88,
+  "sha256": "354fd5f5e4afc2280a19c8541fd4abe38bf8fb73efbeb3c2b0a4f2b1d9e0c7a1",
+  "size": 421888,
+  "status": "completed",
+  "verdict": "malicious",
+  "verdict_raw": null
+}
+```
+
+Progress goes to stderr and the result to stdout, so `| jq` works while you
+still see the wait.
+
+## Plans
+
+A Community key works and runs a **network isolated** scan: no internet egress
+from the sandbox, and no threat intelligence or AI layer on the report. The tool
+says so under the verdict when a layer did not run, rather than leaving an empty
+section to be read as "the sample did nothing". A paid plan adds egress,
+reputation lookups and the AI narrative.
+
+## What this client will not do
+
+- It will not send your key over plain HTTP, or to a host other than the one the
+  key was stored for.
+- It has no `--insecure`. TLS is verified, always. `--ca-bundle` exists for a
+  private deployment.
+- It does not follow redirects, because that is how a bearer token walks onto
+  somebody else's host.
+- It refuses a symlink, a device, a pipe and anything that looks like a private
+  key or a credential file, unless you insist.
+- It treats everything the server sends as untrusted text: terminal escapes,
+  overwrite characters and bidirectional overrides are removed before anything
+  is printed, and the verdict is looked up in a fixed table rather than printed
+  as the server spelled it.
+
+## Links
+
+- Platform: <https://malwagon.com>
+- API reference: <https://malwagon.com/docs/api>

malwagon-0.1.0/README.md

@@ -0,0 +1,133 @@
+# malwagon
+
+Submit a file to the [Malwagon](https://malwagon.com) malware analysis sandbox
+from the command line, wait for the detonation to finish, and print the verdict.
+
+```console
+$ malwagon suspicious.exe
+uploading suspicious.exe (412.0 KB) to malwagon.com
+scan 48213 queued
+waiting for the sandbox, usually 90 to 300 seconds
+  queued       0s elapsed
+  running      12s elapsed
+  analyzing    2m 18s elapsed
+
+  MALICIOUS  score 88/100
+  sha256 354fd5f5e4afc2280a19c8541fd4abe38bf8fb73efbeb3c2b0a4f2b1d9e0c7a1
+  report https://malwagon.com/s/48213
+```
+
+## Install
+
+```console
+pip install malwagon
+```
+
+Works on Linux, macOS and Windows, on Python 3.8 and newer. It has **no
+dependencies** - the standard library makes the request.
+
+## An API key
+
+Every scan needs one. Mint it in the console under **Settings -> API tokens**,
+give it the submit permission, then store it once:
+
+```console
+$ malwagon login
+Malwagon API key for malwagon.com: 
+key accepted and saved to ~/.config/malwagon/config.json
+```
+
+Or keep it in the environment instead, which is what CI usually wants:
+
+```console
+export MALWAGON_API_KEY=mwg_...
+```
+
+There is deliberately **no `--api-key` flag**. A key on the command line is
+visible to every process on the machine and is written verbatim into your shell
+history.
+
+## Usage
+
+```console
+malwagon FILE [options]
+```
+
+| | |
+|---|---|
+| `--json` | print one JSON object and nothing else |
+| `--no-wait` | submit and exit with the scan id |
+| `--private` | keep the report private (needs a plan that includes it) |
+| `--internet` | detonate with internet access (paid plans only) |
+| `--os KEY` | force a sandbox image |
+| `--timeout-run N` | how long to let the sample run |
+| `--quiet` | drop the progress lines, keep the result |
+
+`malwagon --help` lists all of them.
+
+**The sandbox is chosen from the file, not from a flag.** A Windows binary
+detonates on Windows, an ELF or a Python package on the Linux sandbox, a driver
+reaches the kernel analyzer. Pass `--os` only when you want to override that.
+
+## Exit codes
+
+| code | meaning |
+|---|---|
+| 0 | clean |
+| 1 | malicious |
+| 2 | error |
+| 3 | suspicious |
+
+So a pipeline can gate on it:
+
+```console
+malwagon build/output.exe --quiet || echo "do not ship this"
+```
+
+## Machine-readable output
+
+```console
+$ malwagon sample.dll --json
+{
+  "limitations": [],
+  "report_url": "https://malwagon.com/s/48213",
+  "scan_id": 48213,
+  "score": 88,
+  "sha256": "354fd5f5e4afc2280a19c8541fd4abe38bf8fb73efbeb3c2b0a4f2b1d9e0c7a1",
+  "size": 421888,
+  "status": "completed",
+  "verdict": "malicious",
+  "verdict_raw": null
+}
+```
+
+Progress goes to stderr and the result to stdout, so `| jq` works while you
+still see the wait.
+
+## Plans
+
+A Community key works and runs a **network isolated** scan: no internet egress
+from the sandbox, and no threat intelligence or AI layer on the report. The tool
+says so under the verdict when a layer did not run, rather than leaving an empty
+section to be read as "the sample did nothing". A paid plan adds egress,
+reputation lookups and the AI narrative.
+
+## What this client will not do
+
+- It will not send your key over plain HTTP, or to a host other than the one the
+  key was stored for.
+- It has no `--insecure`. TLS is verified, always. `--ca-bundle` exists for a
+  private deployment.
+- It does not follow redirects, because that is how a bearer token walks onto
+  somebody else's host.
+- It refuses a symlink, a device, a pipe and anything that looks like a private
+  key or a credential file, unless you insist.
+- It treats everything the server sends as untrusted text: terminal escapes,
+  overwrite characters and bidirectional overrides are removed before anything
+  is printed, and the verdict is looked up in a fixed table rather than printed
+  as the server spelled it.
+
+## Links
+
+- Platform: <https://malwagon.com>
+- API reference: <https://malwagon.com/docs/api>

malwagon-0.1.0/pyproject.toml

@@ -0,0 +1,56 @@
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[project]
+name = "malwagon"
+dynamic = ["version"]
+description = "Submit a file to the Malwagon malware analysis sandbox and print the verdict."
+readme = "README.md"
+requires-python = ">=3.8"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Malwagon", email = "info@malwagon.com" }]
+keywords = ["malware", "malware-analysis", "sandbox", "security", "threat-intelligence", "cli", "dfir"]
+dependencies = []
+
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Environment :: Console",
+  "Intended Audience :: Information Technology",
+  "Intended Audience :: System Administrators",
+  "Intended Audience :: Developers",
+  "Topic :: Security",
+  "Topic :: System :: Systems Administration",
+  "Topic :: Utilities",
+  "Operating System :: OS Independent",
+  "Operating System :: POSIX :: Linux",
+  "Operating System :: Microsoft :: Windows",
+  "Operating System :: MacOS :: MacOS X",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.8",
+  "Programming Language :: Python :: 3.9",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+]
+
+[project.urls]
+Homepage = "https://malwagon.com"
+Documentation = "https://malwagon.com/docs/api"
+
+[project.scripts]
+malwagon = "malwagon.cli:main"
+
+[tool.hatch.version]
+path = "src/malwagon/__init__.py"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/malwagon"]
+
+# An ALLOWLIST, never an exclude list. An sdist built by exclusion ships
+# whatever happened to be sitting in the directory, and this package must be
+# provably free of anything that is not these five things.
+[tool.hatch.build.targets.sdist]
+include = ["src", "README.md", "LICENSE", "pyproject.toml"]

malwagon-0.1.0/src/malwagon/__init__.py

@@ -0,0 +1,13 @@
+"""Malwagon command line client.
+
+Submits a file to the Malwagon malware analysis sandbox, waits for the
+detonation to finish, and prints the verdict.
+
+Standard library only, on purpose. A security tool that pulls four transitive
+dependencies to make one HTTPS request has widened its own supply chain for a
+convenience, and every one of those maintainer keys becomes a way into the
+machines this runs on.
+"""
+
+__version__ = "0.1.0"
+__all__ = ["__version__"]